-*- coding: utf-8 -*- Changes with Apache 2.4.39 *) SECURITY: CVE-2019-0197 (cve.mitre.org) mod_http2: fixes a possible crash when HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host. An Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Servers that never enabled the h2 protocol or only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue. [Stefan Eissing] *) SECURITY: CVE-2019-0196 (cve.mitre.org) mod_http2: using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparision when determining the method of a request and thus process the request incorrectly. [Stefan Eissing] *) SECURITY: CVE-2019-0211 (cve.mitre.org) MPMs unix: Fix a local priviledge escalation vulnerability by not maintaining each child's listener bucket number in the scoreboard, preventing unprivileged code like scripts run by/on the server (e.g. via mod_php) from modifying it persistently to abuse the priviledged main process. [Charles Fol , Yann Ylavic] *) SECURITY: CVE-2019-0196 (cve.mitre.org) mod_http2: using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparision when determining the method of a request and thus process the request incorrectly. [Stefan Eissing] *) SECURITY: CVE-2019-0217 (cve.mitre.org) mod_auth_digest: Fix a race condition checking user credentials which could allow a user with valid credentials to impersonate another, under a threaded MPM. PR 63124. [Simon Kappel ] *) SECURITY: CVE-2019-0215 (cve.mitre.org) mod_ssl: Fix access control bypass for per-location/per-dir client certificate verification in TLSv1.3. *) SECURITY: CVE-2019-0220 (cve.mitre.org) Merge consecutive slashes in URL's. Opt-out with `MergeSlashes OFF`. [Eric Covener] *) mod_proxy/ssl: Cleanup per-request SSL configuration anytime a backend connection is recycled/reused to avoid a possible crash with some SSLProxy configurations in or context. PR 63256. [Yann Ylavic] *) mod_log_config: Support %{c}h for conn-hostname, %h for useragent_host PR 55348 *) mod_socache_redis: Support for Redis as socache storage provider. *) core: new configuration option 'MergeSlashes on|off' that controls handling of multiple, consecutive slash ('/') characters in the path component of the request URL. [Eric Covener] *) mod_http2: when SSL renegotiation is inhibited and a 403 ErrorDocument is in play, the proper HTTP/2 stream reset did not trigger with H2_ERR_HTTP_1_1_REQUIRED. Fixed. [Michael Kaufmann] *) mod_http2: new configuration directive: `H2Padding numbits` to control padding of HTTP/2 payload frames. 'numbits' is a number from 0-8, controlling the range of padding bytes added to a frame. The actual number added is chosen randomly per frame. This applies to HEADERS, DATA and PUSH_PROMISE frames equally. The default continues to be 0, e.g. no padding. [Stefan Eissing] *) mod_http2: ripping out all the h2_req_engine internal features now that mod_proxy_http2 has no more need for it. Optional functions are still declared but no longer implemented. While previous mod_proxy_http2 will work with this, it is recommeneded to run the matching versions of both modules. [Stefan Eissing] *) mod_proxy_http2: changed mod_proxy_http2 implementation and fixed several bugs which resolve PR63170. The proxy module does now a single h2 request on the (reused) connection and returns. [Stefan Eissing] *) mod_http2/mod_proxy_http2: proxy_http2 checks correct master connection aborted status to trigger immediate shutdown of backend connections. This is now always signalled by mod_http2 when the the session is being released. proxy_http2 now only sends a PING frame to the backend when there is not already one in flight. [Stefan Eissing] *) mod_proxy_http2: fixed an issue where a proxy_http2 handler entered an infinite loop when encountering certain errors on the backend connection. See . [Stefan Eissing] *) mod_http2: Configuration directives H2Push and H2Upgrade can now be specified per Location/Directory, e.g. disabling PUSH for a specific set of resources. [Stefan Eissing] *) mod_http2: HEAD requests to some module such as mod_cgid caused the stream to terminate improperly and cause a HTTP/2 PROTOCOL_ERROR. Fixes . [Michael Kaufmann] *) http: Fix possible empty response with mod_ratelimit for HEAD requests. PR 63192. [Yann Ylavic] *) mod_cache_socache: Avoid reallocations and be safe with outgoing data lifetime. [Yann Ylavic] *) mod_http2: enable re-use of slave connections again. Fixed slave connection keepalives counter. [Stefan Eissing] *) mod_reqtimeout: Allow to configure (TLS-)handshake timeouts. PR 61310. [Yann Ylavic] *) mod_proxy_wstunnel: Fix websocket proxy over UDS. PR 62932 *) mod_ssl: Don't unset FIPS mode on restart unless it's forced by configuration (SSLFIPS on) and not active by default in OpenSSL. PR 63136. [Yann Ylavic] [Apache 2.3.0-dev includes those bug fixes and changes with the Apache 2.2.xx tree as documented, and except as noted, below.] Changes with Apache 2.2.x and later: *) http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/CHANGES?view=markup Changes with Apache 2.0.x and later: *) http://svn.apache.org/viewvc/httpd/httpd/branches/2.0.x/CHANGES?view=markup