Apache 2.2.10

Het ontwikkelteam van het Apache HTTP Server Project heeft een nieuwe versie van hun Apache-http-server uitgegeven. Deze webserver wordt op veel platformen gebruikt en is met behulp van modules met allerlei functionaliteiten uit te rusten. Het versienummer is aangekomen bij 2.2.10 en voorzien van de volgende aankondiging en lijst met aanpassingen:

The Apache Software Foundation and the Apache HTTP Server Project are pleased to announce the release of version 2.2.10 of the Apache HTTP Server ("Apache").

This version of Apache is principally a bug and security fix release. The following potential security flaws are addressed:

• CVE-2008-2939: mod_proxy_ftp: Prevent XSS attacks when using wildcards in the path of the FTP URL. Discovered by Marc Bevand of Rapid7.

We consider this release to be the best version of Apache available, and encourage users of all prior versions to upgrade.

Changes with Apache 2.2.10:

• Allow for smax to be 0 for balancer members so that all idle connections are able to be dropped should they exceed ttl. PR 43371
• mod_proxy_http: Don't trigger a retry by the client if a failure to read the response line was the result of a timeout.
• Support chroot on Unix-family platforms PR 43596
• mod_ssl: implement dynamic mutex callbacks for the benefit of OpenSSL.
• mod_proxy_balancer: Add 'bybusyness' load balance method.
• mod_authn_alias: Detect during startup when AuthDigestProvider is configured to use an incompatible provider via AuthnProviderAlias. PR 45196
• mod_proxy: Add 'scolonpathdelim' parameter to allow for ';' to also be used as a session path separator/delim PR 45158.
• mod_charset_lite: Avoid dropping error responses by handling meta buckets correctly. PR 45687
• mod_proxy_http: Introduce environment variable proxy-initial-not-pooled to avoid reusing pooled connections if the client connection is an initial connection. PR 37770.
• mod_rewrite: Allow Cookie option to set secure and HttpOnly flags. PR 44799
• mod_ssl: Rewrite shmcb to avoid memory alignment issues. PR 42101.
• mod_proxy: Add connectiontimeout parameter for proxy workers in order to be able to set the timeout for connecting to the backend separately. PR 45445
• mod_dav_fs: Retrieve minimal system information about directory entries when walking a DAV fs, resolving a performance degradation on Windows. PR 45464.
• mod_cgid: Pass along empty command line arguments from an ISINDEX query that has consecutive '+' characters in the QUERY_STRING, matching the behavior of mod_cgi.
• mod_headers: Prevent Header edit from processing only the first header of possibly multiple headers with the same name and deleting the remaining ones. PR 45333.
• mod_proxy_balancer: Move nonce field in the balancer manager page inside the html form where it belongs. PR 45578.
• mod_proxy_http: Do not forward requests with 'Expect: 100-continue' to known HTTP/1.0 servers. Return 'Expectation failed' (417) instead.
• mod_rewrite: Preserve the query string when [proxy,noescape]. PR 45247.