-
apache2 (2.2.9-10+lenny12) lenny-security; urgency=high
* Prevent unintended pattern expansion in some reverse proxy
configurations by strictly validating the request-URI. Fixes
CVE-2011-3368, CVE-2011-3639, CVE-2011-4317.
* CVE-2011-3607: Fix integer overflow in ap_pregsub(), which allowed local
privilege escalation.
* CVE-2012-0031: Fix client process being able to crash parent process
during shutdown.
* CVE-2012-0053: Fix an issue in code 400 error responses that could expose
"httpOnly" cookies.
-- Stefan Fritsch <email address hidden> Sun, 05 Feb 2012 21:56:02 +0100
-
apache2 (2.2.9-10+lenny11) lenny-security; urgency=high
* Fix regressions related to range requests introduced by 2.2.9-10+lenny10.
Closes: #639825
-- Stefan Fritsch <email address hidden> Sun, 04 Sep 2011 22:09:38 +0200
-
apache2 (2.2.9-10+lenny9) stable-security; urgency=high
* Add the new SSLInsecureRenegotiation directive to configure if clients that have not been patched to support secure renegotiation (RFC 5746) are allowed to connect (CVE-2009-3555). Together with the recent openssl upgrade, this closes: #587037 This upgrade also adds support for the SSL_SECURE_RENEG variable, to allow testing if secure renegotiation is supported by the client. -- Stefan Fritsch <email address hidden> Sat, 11 Dec 2010 19:45:28 +0100
-
apache2 (2.2.9-10+lenny8) stable; urgency=low
* Add missing psmisc dependency for killall used in the init script.
Closes: #568542
* Fix potential memory leaks related to the usage of apr_brigade_destroy().
-- Stefan Fritsch <email address hidden> Mon, 19 Apr 2010 21:17:33 +0200
-
apache2 (2.2.9-10+lenny6) stable-security; urgency=high
* Security:
- Reject any client-initiated SSL/TLS renegotiations. This is a partial fix
for the TLS renegotiation prefix injection attack (CVE-2009-3555).
Any configuration which requires renegotiation for per-directory/location
access control or uses "SSLVerifyClient optional" is still vulnerable.
-- Stefan Fritsch <email address hidden> Sat, 14 Nov 2009 21:10:47 +0100
-
apache2 (2.2.9-10+lenny4) stable-security; urgency=high
* Security fixes:
- CVE-2009-1890: denial of service in mod_proxy (closes: #536718)
- CVE-2009-1891: denial of service in mod_deflate (closes: #534712)
Also prevent compressing the content for HEAD requests.
-- Stefan Fritsch <email address hidden> Tue, 14 Jul 2009 21:53:01 +0200
-
apache2 (2.2.9-10+lenny2) testing-proposed-updates; urgency=low
* Report an error instead instead of segfaulting when apr_pollset_create
fails (PR 46467). On Linux kernels since 2.6.27.8, the value in
/proc/sys/fs/epoll/max_user_instances needs to be larger than twice the
value of MaxClients in the Apache configuration. Closes: #511103
-- Stefan Fritsch <email address hidden> Tue, 20 Jan 2009 18:17:27 +0100
-
apache2 (2.2.9-10+lenny1) testing-proposed-updates; urgency=low
* Regression fix from upstream svn for mod_proxy:
Prevent segmentation faults by correctly adjusting the lifetime of the
buckets read from the proxy backend. PR 45792
* Fix from upstream svn for mpm_worker:
Crosscheck that idle workers are still available before using them and
thus preventing an overflow of the worker queue which causes a SegFault.
PR 45605
* Add a comment to ports.conf to point to NEWS.Debian.gz in case of
upgrading problems.
-- Stefan Fritsch <email address hidden> Tue, 02 Dec 2008 22:00:50 +0100
-
apache2 (2.2.9-10) unstable; urgency=low
* Regression fix from upstream svn for mod_proxy_http:
Don't trigger a retry by the client if a failure to read the response line
was the result of a timeout.
-- Stefan Fritsch <email address hidden> Wed, 01 Oct 2008 11:50:18 +0200
