apache2 2.4.9-1ubuntu1 source package in Ubuntu

Changelog

apache2 (2.4.9-1ubuntu1) utopic; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - debian/{control, apache2.install, apache2-utils.ufw.profile,
      apache2.dirs}: Add ufw profiles.
    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
    - d/control, d/config-dir/mods-available/ssl.conf, d/ask-for-passphrase,
      d/apache2.install, d/tests/ssl-passphrase: Plymouth aware passphrase
      dialog program ask-for-passphrase.
    - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE to
      configure.
    - debian/patches/086_svn_cross_compiles: Backport several cross fixes from
      upstream
    - Build using lua5.2.
    - d/tests/chroot: dep8 test for ChrootDir case.
    - d/tests/ssl-passphrase: update for new default path /var/www/html.
    - d/tests/duplicate-module-load: check for duplicate module loads.
    - d/index.html: replace Debian with Ubuntu on default page (LP: #1288690).
    - d/p/split-logfile.patch: fix completely broken split-logfile command
      (LP: #1299162). Thanks to Holger Mauermann.
  * Drop changes (upstreamed):
    - d/p/ignore-quilt-dir: adjust build system so that it does not use
      files find inside the .pc directory. This stops a double module load
      causing later havoc, including "ChrootDir" directive failure.
    - debian/patches/CVE-2013-6438.patch: properly calculate correct length
      in modules/dav/main/util.c.
    - debian/patches/CVE-2014-0098.patch: properly parse tokens in
      modules/loggers/mod_log_config.c.
  * d/tests/control: adjust dep8 tests for new "breaks-testbed" facility.

apache2 (2.4.9-1) unstable; urgency=medium

  * New upstream version.
    Security fixes:
    - CVE-2013-6438: mod_dav: Fix DoS from crafted DAV WRITE requests.
    - CVE-2014-0098: mod_log_config: Fix segfaults when logging truncated
                     cookies.
    Notable new features:
    - Support named groups and backreferences within the LocationMatch,
      DirectoryMatch, FilesMatch and ProxyMatch directives.
    - mod_proxy: Added support for unix domain sockets as the backend server
      endpoint.
    - mod_ssl: Add support for OpenSSL configuration commands by introducing
      the SSLOpenSSLConfCmd directive.
    - mod_authz_user, mod_authz_host, mod_authz_groupfile, mod_authz_dbm,
      mod_authz_dbd, mod_authnz_ldap: Support the expression parser within the
      require directives.
    - mod_rewrite: Add RewriteOptions InheritDown, InheritDownBefore,
      and IgnoreInherit.
    - Bugfix in the build system to avoid problems with patched config.m4
      files as in LP #1251939.
  * Make default cipher list in ssl.conf more secure:
    - Remove 'MEDIUM'. This disables RC4 and SEED. Also remove '!MD5' because
      'HIGH' does not include MD5.
    - Remove the 'Speed-optimized SSL Cipher' configuration example because
      it depends on RC4, which is considered insecure.
  * Change init script short description to describe the service, not the
    script.  Closes: #738315
  * Bump Standards-Version (no changes).
 -- Robie Basak <email address hidden>   Fri, 09 May 2014 19:30:04 +0000