Changes with Apache 2.2.22

• SECURITY: CVE-2011-3368 (cve.mitre.org)
  Reject requests where the request-URI does not match the HTTP specification, preventing unexpected expansion of target URLs in some reverse proxy configurations. [Joe Orton]
• SECURITY: CVE-2011-3607 (cve.mitre.org)
  Fix integer overflow in ap_pregsub() which, when the mod_setenvif module is enabled, could allow local users to gain privileges via a .htaccess file. [Stefan Fritsch, Greg Ames]
• SECURITY: CVE-2011-4317 (cve.mitre.org)
  Resolve additional cases of URL rewriting with ProxyPassMatch or RewriteRule, where particular request-URIs could result in undesired backend network exposure in some configurations. [Joe Orton]
• SECURITY: CVE-2012-0021 (cve.mitre.org)
  mod_log_config: Fix segfault (crash) when the '%{cookiename}C' log format string is in use and a client sends a nameless, valueless cookie, causing a denial of service. The issue existed since version 2.2.17. PR 52256. [Rainer Canavan (rainer-apache 7val com)]
• SECURITY: CVE-2012-0031 (cve.mitre.org)
  Fix scoreboard issue which could allow an unprivileged child process could cause the parent to crash at shutdown rather than terminate cleanly. [Joe Orton]
• SECURITY: CVE-2012-0053 (cve.mitre.org)
  Fix an issue in error responses that could expose "httpOnly" cookies when no custom ErrorDocument is specified for status code 400. [Eric Covener]
• mod_proxy_ajp: Try to prevent a single long request from marking a worker in error. [Jean-Frederic Clere]
• config: Update the default mod_ssl configuration: Disable SSLv2, only allow >= 128bit ciphers, add commented example for speed optimized cipher list, limit MSIE workaround to MSIE <= 5. [Kaspar Brand]
• core: Fix segfault in ap_send_interim_response(). PR 52315. [Stefan Fritsch]
• mod_log_config: Prevent segfault. PR 50861. [Torsten Foertsch (torsten.foertsch gmx.net)]
• mod_win32: Invert logic for env var UTF-8 fixing.
  Now we exclude a list of vars which we know for sure they dont hold UTF-8 chars; all other vars will be fixed. This has the benefit that now also all vars from 3rd-party modules will be fixed. PR 13029 / 34985. [Guenter Knauf]
• core: Fix hook sorting for Perl modules, a regression introduced in 2.2.21. PR: 45076. [Torsten Foertsch (torsten foertsch gmx net)]
• Fix a regression introduced by the CVE-2011-3192 byterange fix in 2.2.20: A range of '0-' will now return 206 instead of 200. PR 51878. [Jim Jagielski]
• Example configuration: Fix entry for MaxRanges (use "unlimited" instead of "0"). [Rainer Jung]
• mod_substitute: Fix buffer overrun. [Ruediger Pluem, Rainer Jung]

Changes with Apache 2.2.21

• SECURITY: CVE-2011-3348 (cve.mitre.org)
  mod_proxy_ajp: Respond with HTTP_NOT_IMPLEMENTED when the method is not recognized. [Jean-Frederic Clere]
• Fix a regression introduced by the CVE-2011-3192 byterange fix in 2.2.20. PR 51748. [<lowprio20 gmail.com>]
• mod_filter: Instead of dropping the Accept-Ranges header when a filter registered with AP_FILTER_PROTO_NO_BYTERANGE is present, set the header value to "none". [Eric Covener, Ruediger Pluem]
• mod_proxy_ajp: Ignore flushing if headers have not been sent. PR 51608 [Ruediger Pluem]
• mod_dav_fs: Fix segfault if apr DBM driver cannot be loaded. PR 51751. [Stefan Fritsch]
• mod_alias: Adjust log severity of "incomplete redirection target" message. PR 44020.
• mod_rewrite: Check validity of each internal (int:) RewriteMap even if the RewriteEngine is disabled in server context, avoiding a crash while referencing the invalid int: map at runtime. PR 50994. [Ben Noordhuis <info noordhuis nl>]
• core: Allow MaxRanges none|unlimited|default and set 'Accept-Ranges: none' in the case Ranges are being ignored with MaxRanges none. [Eric Covener]
• mod_proxy_ajp: Respect "reuse" flag in END_REPONSE packets. [Rainer Jung]

Changes with Apache 2.2.20

• SECURITY: CVE-2011-3192 (cve.mitre.org)
  core: Fix handling of byte-range requests to use less memory, to avoid denial of service. If the sum of all ranges in a request is larger than the original file, ignore the ranges and send the complete file. PR 51714. [Stefan Fritsch, Jim Jagielski, Ruediger Pluem, Eric Covener]
• mod_authnz_ldap: If the LDAP server returns constraint violation, don't treat this as an error but as "auth denied". [Stefan Fritsch]
• mod_filter: Fix FilterProvider conditions of type "resp=" (response headers) for CGI. [Joe Orton, Rainer Jung]
• mod_reqtimeout: Fix a timed out connection going into the keep-alive state after a timeout when discarding a request body. PR 51103. [Stefan Fritsch]
• core: Do the hook sorting earlier so that the hooks are properly sorted for the pre_config hook and during parsing the config. [Stefan Fritsch]

Changes with Apache 2.2.19

• Revert ABI breakage in 2.2.18 caused by the function signature change of ap_unescape_url_keep2f(). This release restores the signature from 2.2.17 and prior, and introduces ap_unescape_url_keep2f_ex(). [Eric Covener]

Changes with Apache 2.2.18 May 11, 2011

• Log an error for failures to read a chunk-size, and return 408 instead 413 when this is due to a read timeout. This change also fixes some cases of two error documents being sent in the response for the same scenario.
  [Eric Covener] PR49167
• core: Only log a 408 if it is no keepalive timeout.
  PR 39785 [Ruediger Pluem, Mark Montague ]
• core: Treat timeout reading request as 408 error, not 400. Log 408 errors in access log as was done in Apache 1.3.x.
  PR 39785 [Nobutaka Mantani , Stefan Fritsch, Dan Poirier]
• Core HTTP: disable keepalive when the Client has sent Expect: 100-continue but we respond directly with a non-100 response. Keepalive here led to data from clients continuing being treated as a new request.
  PR 47087. [Nick Kew]
• htpasswd: Change the default algorithm for htpasswd to MD5 on all platforms. Crypt with its 8 character limit is not useful anymore; improve out of disk space handling (PR 30877); print a warning if a password is truncated by crypt.
  [Stefan Fritsch]
• mod_win32: Added shebang check for '! so that .vbs scripts work as CGI. Win32's cscript interpreter can only use a single quote as comment char.
  [Guenter Knauf]
• configure: Fix htpasswd/htdbm libcrypt link errors with some newer linkers.
  [Stefan Fritsch]
• MinGW build improvements.
  PR 49535. [John Vandenberg , Jeff Trawick]
• mod_ssl, ab: Support OpenSSL compiled without SSLv2 support.
  [Stefan Fritsch]
• core: AllowEncodedSlashes new option NoDecode to allow encoded slashes in request URL path info but not decode them.
  PR 35256, PR 46830. [Dan Poirier]
• mod_rewrite: Allow to unset environment variables.
  PR 50746. [Rainer Jung]
• suEXEC: Add Suexec directive to disable suEXEC without renaming the binary (Suexec Off), or force startup failure if suEXEC is required but not supported (Suexec On).
  [Jeff Trawick]
• mod_proxy: Put the worker in error state if the SSL handshake with the backend fails.
  PR 50332. [Daniel Ruggeri , Ruediger Pluem]
• prefork: Update MPM state in children during a graceful restart. Allow the HTTP connection handling loop to terminate early during a graceful restart.
  PR 41743. [Andrew Punch ]
• mod_ssl: Correctly read full lines in input filter when the line is incomplete during first read.
  PR 50481. [Ruediger Pluem]
• mod_autoindex: Merge IndexOptions from server to directory context when the directory has no mod_autoindex directives.
  PR 47766. [Eric Covener]
• mod_cache: Make sure that we never allow a 304 Not Modified response that we asked for to leak to the client should the 304 response be uncacheable.
  PR45341 [Graham Leggett]
• mod_dav: Send 400 error if malformed Content-Range header is received for a put request (RFC 2616 14.16).
  PR 49825. [Stefan Fritsch]
• mod_userdir: Add merging of enable, disable, and filename arguments to UserDir directive, leaving enable/disable of userlists unmerged.
  PR 44076 [Eric Covener]
• core: Honor 'AcceptPathInfo OFF' during internal redirects, such as per-directory mod_rewrite substitutions.
  PR 50349. [Eric Covener]
• mod_cache: Check the request to determine whether we are allowed to return cached content at all, and respect a "Cache-Control: no-cache" header from a client. Previously, "no-cache" would behave like "max-age=0".
  [Graham Leggett]
• mod_mem_cache: Add a debug msg when a streaming response exceeds MCacheMaxStreamingBuffer, since mod_cache will follow up with a scary 'memory allocation failed' debug message.
  PR 49604. [Eric Covener]
• proxy_connect: Don't give up in the middle of a CONNECT tunnel when the child process is starting to exit.
  PR50220. [Eric Covener]

• SECURITY: CVE-2010-1623 (cve.mitre.org) [apr-util 1.3.10]
  Fix a denial of service attack against apr_brigade_split_line(). [Stefan Fritsch]
• SECURITY: CVE-2009-3560, CVE-2009-3720 (cve.mitre.org) [apr-util 1.3.10]
  Fix two buffer over-read flaws in the bundled copy of expat which could cause applications to crash while parsing specially-crafted XML documents. [Joe Orton]
• prefork MPM: Run cleanups for final request when process exits gracefully to work around a flaw in apr-util. PR 43857. [Tom Donovan]
• mod_reqtimeout: Do not wrongly enforce timeouts for mod_proxy's backend connections and other protocol handlers (like mod_ftp). Enforce the timeout for AP_MODE_GETLINE. If there is a timeout, shorten the lingering close time from 30 to 2 seconds. [Stefan Fritsch]
• Proxy balancer: support setting error status according to HTTP response code from a backend. PR 48939. [Daniel Ruggeri ]
• mod_authnz_ldap: If AuthLDAPCharsetConfig is set, also convert the password to UTF-8. PR 45318. [Johannes Müller , Stefan Fritsch]
• core: check symlink ownership if both FollowSymlinks and SymlinksIfOwnerMatch are set [Nick Kew]
• core: fix origin checking in SymlinksIfOwnerMatch PR 36783 [Robert L Mathews ]
• mod_headers: Enable multi-match-and-replace edit option PR 46594 [Nick Kew]
• mod_log_config: Make ${cookie}C correctly match whole cookie names instead of substrings. PR 28037. [Dan Franklin , Stefan Fritsch]
• mod_dir, mod_negotiation: Pass the output filter information to newly created sub requests; as these are later on used as true requests with an internal redirect. This allows for mod_cache et.al. to trap the results of the redirect.
  PR 17629, 43939 [Dirk-Willem van Gulik, Jim Jagielski, Joe Orton, Ruediger Pluem]
• rotatelogs: Fix possible buffer overflow if admin configures a mongo log file path. [Jeff Trawick]
• mod_ssl: Do not do overlapping memcpy. PR 45444 [Joe Orton]
• vhost: A purely-numeric Host: header should not be treated as a port. PR 44979 [Nick Kew]
• core: (re)-introduce -T commandline option to suppress documentroot check at startup.
  PR 41887 [Jan van den Berg ]

• SECURITY: CVE-2010-1452 (cve.mitre.org) mod_dav, mod_cache: Fix Handling of requests without a path segment. PR: 49246 [Mark Drayton, Jeff Trawick]
• SECURITY: CVE-2010-2068 (cve.mitre.org) mod_proxy_ajp, mod_proxy_http, mod_reqtimeout: Fix timeout detection for platforms Windows, Netware and OS2. PR: 49417. [Rainer Jung]
• core: Filter init functions are now run strictly once per request before handler invocation. The init functions are no longer run for connection filters. PR 49328. [Joe Orton]
• mod_filter: enable it to act on non-200 responses. PR 48377 [Nick Kew]
• mod_ldap: LDAP caching was suppressed (and ldap-status handler returns title page only) when any mod_ldap directives were used in VirtualHost context. [Eric Covener]
• mod_ssl: Fix segfault at startup if proxy client certs are shared across multiple vhosts. PR 39915. [Joe Orton]
• mod_proxy_http: Log the port of the remote server in various messages. PR 48812. [Igor Galić ]
• apxs: Fix -A and -a options to ignore whitespace in httpd.conf [Philip M. Gollucci]
• mod_dir: add FallbackResource directive, to enable admin to specify an action to happen when a URL maps to no file, without resorting to ErrorDocument or mod_rewrite. PR 47184 [Nick Kew]
• mod_rewrite: Allow to set environment variables without explicitely giving a value. [Rainer Jung]