09.07.2007 - Apache Group: Apache HTTP Server 2.2.6

The Apache HTTP Server Project is an effort to develop and maintain an open-source HTTP server for modern operating systems including UNIX and Windows NT. The goal of this project is to provide a secure, efficient and extensible server that provides HTTP services in sync with the current HTTP standards. SECURITY: CVE-2007-3847 (cve.mitre.org) mod_proxy: Prevent reading past the end of a buffer when parsing date-related headers. PR 41144. [Davi Arnaut, Nick Kew] SECURITY: CVE-2007-1863 (cve.mitre.org) mod_cache: Prevent a segmentation fault if attributes are listed in a Cache-Control header without any value. [Niklas Edmundsson ] SECURITY: CVE-2007-3304 (cve.mitre.org) prefork, worker, event MPMs: Ensure that the parent process cannot be forced to kill processes outside its process group. [Joe Orton, Jim Jagielski] SECURITY: CVE-2006-5752 (cve.mitre.org) mod_status: Fix a possible XSS attack against a site with a public server-status page and ExtendedStatus enabled, for browsers which perform charset "detection". Reported by Stefan Esser. [Joe Orton] SECURITY: CVE-2007-1862 (cve.mitre.org) mod_mem_cache: Copy headers into longer lived storage; header names and values could previously point to cleaned up storage. PR 41551. [Davi Arnaut ] mod_info: mod_info outputs invalid XHTML 1.0 transitional. PR 42847 [Rici Lake ] mod_ssl: Fix spurious hostname mismatch warning for valid wildcard certificates. PR 37911. [Nick Burch ] mod_mem_cache: Increase the minimum and default value for MCacheMinObjectSize from 0 to 1, as a MCacheMinObjectSize of 0 does not make sense and leads to a division by zero. PR 40576. [Xuekun Hu ] mod_cache: Remove expired content from cache that cannot be revalidated. PR 30370. [Ruediger Pluem] mod_proxy_http: accept proxy-sendchunked/proxy-sendchunks as synonymous. PR 43183 [Brian Rectanus , Vincent Bray] mod_proxy: Ensure that at least scheme://hostname[:port] matches between worker and URL when searching for the best fitting worker for a given URL. PR 40910 [Ruediger Pluem] mod_proxy: Improve network performance by setting APR_TCP_NODELAY (disable Nagle algorithm) on sockets if implemented. PR 42871 [Christian BOITEL , Jim Jagielski] core: Do not replace a Date header set by a proxied backend server. PR 40232 [Ruediger Pluem] mod_proxy: Add a missing assignment in an error checking code path. PR 40865 [Andrew Rucker Jones ] mod_proxy_connect: avoid segfault on DNS lookup failure. PR 40756 [Trevin Beattie ] mod_proxy: enable Ignore Errors option on ProxyPass Status. PR 43167 [Francisco Gimeno mod_proxy_http: Don't try to read body of a HEAD request before responding. PR 41644 [Stuart Children ] mod_authnz_ldap: Don't return HTTP_UNAUTHORIZED during authorization when LDAP authentication is configured but we haven't seen any 'Require ldap-*' directives, allowing authorization to be passed to lower level modules (e.g. Require valid-user) PR 43281 [Eric Covener] mod_proxy: don't URLencode tilde in path component PR 38448 [Stijn Hoop ] proxy/ajp_header.c: Fixed header token string comparisons Matching of header tokens failed to include the trailing NIL byte and could misinterpret a longer header token for a shorter. Additionally, a "Content-Type" comparison was made case insensitive. [Martin Kraemer] proxy/ajp_header.c: Backport of an AJP protocol fix for EBCDIC On EBCDIC machines, the status_line string was incorrectly converted twice. [Jean-Frederic Clere, Martin Kraemer] mod_dumpio: Fix for correct dumping of traffic on EBCDIC hosts Data had been incorrectly converted twice, resulting in garbled log output. [Martin Kraemer] mod_autoindex: Add in Type and Charset options to IndexOptions directive. This allows the admin to explicitly set the content-type and charset of the generated page and is therefore a viable workaround for buggy browsers affected by CVE-2007-4465 (cve.mitre.org). [Jim Jagielski] log core: ensure we use a special pool for stderr logging, so that the stderr channel remains valid from the time plog is destroyed, until the time the open_logs hook is called again. [William Rowe] mod_negotiation: preserve Query String in resolving a type map PR 33112 [Jørgen Thomsen , Nick Kew] mod_ssl: Version reporting update; displays 'compiled against' Apache and build-time SSL Library versions at loglevel [info], while reporting the run-time SSL Library version in the server info tags. Helps to identify a mod_ssl built against one flavor of OpenSSL but running against another (also adds SSL-C version number reporting.) [William Rowe] mime.types: Many updates to sync with IANA registry and common unregistered types that the owners refuse to register. Admins are encouraged to update their installed mime.types file. PR: 35550, 37798, 39317, 31483 [Roy T. Fielding] mod_expires: don't crash on bad configuration data PR 43213 [Julien Perez ] mod_dbd: Introduce configuration groups to allow inheritance by virtual hosts of database configurations from the main server. Determine the minimal set of distinct configurations and share connection pools whenever possible. Allow virtual hosts to override inherited SQL statements. PR 41302. [Chris Darroch] mod_dbd: Create memory sub-pools for each DB connection and close DB connections in a pool cleanup function. Ensure prepared statements are destroyed before DB connection is closed. When using reslists, prevent segfaults when child processes exit, and stop memory leakage of ap_dbd_t structures. Avoid use of global s->process->pool, which isn't destroyed by exiting child processes in most multi-process MPMs. PR 39985. [Chris Darroch, Nick Kew] mod_dbd: Handle error conditions in dbd_construct() properly. Simplify ap_dbd_open() and use correct arguments to apr_dbd_error() when non-threaded. Register correct cleanup data in non-threaded ap_dbd_acquire() and ap_dbd_cacquire(). Clean up configuration data and merge function. Use ap_log_error() wherever possible. [Chris Darroch, Nick Kew] mod_dbd: Stash DBD connections in request_config of initial request only, or else sub-requests and internal redirections may cause entire DBD pool to be stashed in a single HTTP request. [Chris Darroch] main core: Emit errors during the initial apr_app_initialize() or apr_pool_create() (when apr-based error reporting is not ready). [William Rowe, Jeff Trawick] log core: fix the new piped logger case where we couldn't connect the replacement stderr logger's stderr to the NULL stdout stream. Continue in this case, since the previous alternative of no error logging at all (/dev/null) is far worse. [William Rowe] mpm_winnt: Prevent the parent-child pipe from leaking into other spawned processes, and ensure we have a /Device/null handle for stdout when running as-a-service. [William Rowe] mod_ldap: Avoid possible crashes, hangs, and busy loops due to improper merging of the cache lock in vhost config PR 43164 [Eric Covener] ApacheMonitor: Fix Windows Vista detection. [Mladen Turk] mod_deflate: fix protocol handling in deflate input filter PR 23287 [Nick Kew] mime.types: add Registered Javascript/ECMAScript MIME types (RFC4329) PR 40299 [Dave Hodder ] mod_filter: fix integer comparisons in dispatch rules PR 41835 [Nick Kew] mod_filter: fix merging of ! and = in FilterChain PR 42186 [Issac Goldstand ] mod_deflate: don't try to process metadata buckets as data. what should have been a 413 error was logged as a 500 and a blank screen appeared at the browser. [Greg Ames, Ruediger Pluem] mod_cgi, mod_cgid: Fix use of CGI scripts as ErrorDocuments. PR 39710. [Paul Querna, Ruediger Pluem] mod_proxy: Allow to use different values for sessionid in url encoded id and cookies. PR 41897. [Jean-Frederic Clere] mod_proxy: Fix the 503 returned when session route does not match any of the balancer members. [Mladen Turk] mod_proxy: Added ProxyPassMatch directive, which is similar to ProxyPass but takes a regex local path prefix. [Jim Jagielski] mod_cache: Do not set Date or Expires when they are missing from the original response or are invalid. [Justin Erenkrantz] mod_cache: Correctly handle HEAD requests on expired cache content. PR 41230. [Niklas Edmundsson ] mod_cache: Let Cache-Control max-age set the expiration of the cached representation if Expires is not set. [Justin Erenkrantz] mod_cache: Allow caching of requests with query arguments when Cache-Control max-age is explicitly specified. [Justin Erenkrantz] mod_disk_cache: Allow Vary'd responses to be refreshed properly. [Justin Erenkrantz] mod_proxy: Print the correct error message for erroneous configured ProxyPass directives. PR 40439. [Takashi Sato ] mod_so: Provide more helpful LoadModule feedback when an error occurs. [William Rowe] mod_alias: Accept path components (URL part) in Redirects. PR 35314. [Nick Kew] mod_headers: Allow % at the end of a Header value. PR 36609. [Nick Kew, Ruediger Pluem] mod_cache: Use the same cache key throughout the whole request processing to handle escaped URLs correctly. PR 41475. [Ruediger Pluem] mod_cache: Add CacheIgnoreQueryString directive. PR 41484. [Fredrik Widlund ] mod_cache: While serving a cached entity ensure that filters that have been applied to this cached entity before saving it to the cache are not applied again. PR 40090. [Ruediger Pluem] mod_cache: Correctly cache objects whose URL query string has been modified by mod_rewrite. PR 40805. [Ruediger Pluem] HTTP proxy ProxyErrorOverride: Leave 1xx and 3xx responses alone. Only processing of error responses (4xx, 5xx) will be altered. PR 39245. [Jeff Trawick, Bart van der Schans ] htdbm: Enable crypt support on platforms with crypt() but not , such as z/OS. [David Jones ] mod_ssl: initialize thread locks before initializing the hardware acceleration library, so the latter can make use of the former. PR 20951. [] ab.c: Correct behavior of HTTP request headers sent by ab in presence of -H command-line overrides. PR 31268, 26554. [Arvind Srinivasan ] ab.c: The apr_port_t type is unsigned, but ab was using a signed format code in its reports. PR 42070. [Takashi Sato ] mod_ldap: Remove the hardcoded size limit parameter for ldap_search_ext_s and replace it with an APR_ defined value that is set according to the LDAP SDK being used. [David Jones ] core: Correct a regression since 2.0.x in the handling of AllowOverride Options. PR 41829. [Torsten Förtsch ] mod_proxy_http: Handle request bodies larger than 2 GB by converting the Content-Length header of the request correctly. PR 40883. [Ruediger Pluem, toadie ] mod_proxy: Fix some proxy setting inheritance problems (eg: ProxyTimeout). PR 11540. [Stuart Children ] Unix MPMs: Catch SIGFPE so that exception hooks and CoreDumpDirectory can work after that terminating signal. [Eric Covener] Win32: Makefile.win will now build with MS VC 8 (Visual Studio 2005) including embedding the .manifest information into each binary. [William Rowe] - Download Apache HTTP Server - View Release Notes - View Additional Information - Visit Apache Group