ALT Linux repos
| D: | 1.3.41rusPL30.23-alt5 |
| 5.0: | 1.3.42rusPL30.24-alt1.M50.1 |
| 4.1: | 1.3.41rusPL30.23-alt4 |
| 4.0: | 1.3.42rusPL30.23-alt0.M40.1 |
| +updates: | 1.3.39rusPL30.23-alt1 |
| 3.0: | 1.3.33rusPL30.20-alt6 |
Other repositories
| Upstream: | 1.3.41 |
Group :: System/Servers
RPM: apache
Navigation
Main Changelog Spec Patches Sources Download Gear Bugs and FR Repocop
19 october 2005 Alexey Gladkov <legion at altlinux.ru> 1.3.33rusPL30.20-alt6
- NMU: rpm macros fix.
- Mon Oct 03 2005 Artem K. Jouravsky <ujo@altlinux.ru> 1.3.33rusPL30.20-alt5
+ added mod_accel to current builds; off by default (#8029)
+ removed SMP incompatible build
- added SVN patch for CAN-2005-2088 security vulnerability:
when acting as an HTTP proxy, Apache 1.3 allows remote attackers to poison
the web cache, bypass web application firewall protection, and conduct XSS
attacks via an HTTP request with both a "Transfer-Encoding: chunked" header
and a Content-Length header, which causes Apache to incorrectly handle and
forward the body of the request in a way that causes the receiving server
to process it as a separate HTTP request, aka "HTTP Request Smuggling."
+ thanks for SVN pointer to Ubuntu - fixed small port-related problem in sample Vhosts.conf
(thanks Alexey Borovskoy (alb@) for notify/fix; also in alt3.M24.1)
- whoops, README.ALT wasn't getting packaged (updated too)
- altlinux-release build dependency appears illegal
(long unneeded though) - Wed Aug 24 2005 Michael Shigorin <mike@altlinux.org>
+ exchanged httpd and httpd-perl startup/shutdown order;
see README.ALT for further details on mod_perl setup (#4994, #6437)
thanks combr@, tma@, solo@, Ivan Adzhubey for discussion and fixes
(you *will* need to chkconfig them on for this to apply)
+ rolled back #2928 workarounds (should be unneeded)
+ hard kill remaining processes after normal stop() part
+ fixed #6351 (delaycompress in logrotate; may influence #3153)
thanks dfo@, sorry ldv@
+ fixed a transition bug in /etc/init.d/httpd::conftest()
+ UseCanonicalName Off in httpd{,-perl}.conf (#7704)
+ updated and extended README.ALT - Thu Feb 17 2005
+ added missing NameVirtualHost directive to default Vhosts.conf - Sat Feb 12 2005
+ Vhosts.conf thinko fix suggested by Alexey Morozov (morozov@)
(Aug 24: could have lost that.... can't remember details now) - Sat Jan 29 2005
+ macros extended (see README.ALT); also #1735, #5634, #5989
+ re-fixed #4235 (weird hostname hack)
+ implemented separate TMPDIR (addon modules should follow) (#5989)
+ disabled mod_charset for mod_perl (hm... #2941-related)
+ commented out "AddDefaultCharset iso8859-1" by default (#5754)
+ added /var/www/vhosts and /etc/httpd/conf/vhosts.d (#5634)
+ upped HARD_SERVER_LIMIT from 256 to 1024 (#5748; needs additional
/etc/security/limits.conf tweaking to actually happen)
+ changed %suexec_docroot from /home to /var/www (#2461)
+ changed suexec binary permissions (see #5309)
from 4711 root:root
to 4710 root:apache
+ changed TMPDIR in initscripts to use more specific location than /tmp
so that you can restrict apache access to that by ACL and further
configure php and other software running as apache (#5989)
+ added patch to consult POSIX ACLs on CGI execution decision
(#4987; disabled by default, build --with acl_support to enable)
- mod_realip added
- 1.3.33 (minor security fixes)
- security fixes officially released (patch93 removed)
- reverse proxy functionality restored (broken in 1.3.32 -- #5435);
thanks to Leonid Shalupov <ls ls9707 spb edu> for alerting - added htpasswd patch by Larry Cashdollar <lwc vapid ath cx>
(unchecked buffer operations; not much of an issue though)
- fixed build w/o mod_deflate in addition to -alt2 security fixes
(thanks to Alexey Beleckiy <sinister emt com ua>)
- updated security fixes (CAN-2004-0940):
mod_include.c patch from CVS (1.3.33-dev)
thanks to Vladimir Lettiev (crux@) for reminding - see also changelog entry for alt1 (CAN-2004-0492)
- 1.3.32 (security fixes)
- CAN-2004-0492 (cve.mitre.org):
Reject responses from a remote server if sent an invalid (negative)
Content-Length. - added fix off/for http://www.securitylab.ru/48807.html;
thanks to Vladimir Lettiev (crux@) for alerting and verifying - removed log directory cleanup after package deinstallation
(seems like a bad practice)
- fixed #5002 (wrong perms on apache-common binaries excl. sample cgi-bin/*),
thanks Vladimir Lettiev (crux@) for notifying!
- re-fixed #4235. distributed sourcedir can be evil...
- fixed #1735 (Include conf/addon-modules.d/*.conf), thanks to
Igor Muratov (migor@) for buggin' me on this long-standing topic
- fixed #4859 (webmaster group could be absent at apache-common installation)
thanks to Alexander Kuprin (ru_classic mail ru) - tightened permissions on /etc/httpd/conf and /var/www/icons/ as per
Dmitry Levin's request (#2920) -- please use "webmaster" group for
content/configuration access and "apache" group for log access
- fixed #4719 (build condition for M22);
thanks to Pavel Usishev <usishev yandex ru>
- fixed remnants of older internal subpackage versioning
which barred mod_perl-doc installation; thanks to Dmitry Levin (ldv@)
- finally fixed #3153 (log rotation), thanks to Dmitry Levin (ldv@)
- partially reverted group change introduced in 1.3.28rusPL30.18-alt2:
/var/log/httpd permissions changed (#2920)
from 750,root,webmaster
to 750,root,apache - reworked initscript style detection routine along ldv's advice
as relying on "Master" in /etc/altlinux-release for old-style seems
to be getting to the point of being wrong ;-) - added mod_deflate to current builds; off by default (#2905)
- fixed altlinux.html
- /var/www/html/*.gif and /var/www/cgi-bin/* are now
%config(noreplace); added /var/www/html/README.txt (#3715)
- fixed default httpd{-perl,}.conf regarding Ukrainian charsets and content
preferences; see http://lists.osdn.org.ua/wws/arc/linux/2004-06/msg00103.html,
thanks to Bohdan Vlasyuk <bohdan kivc vstu vinnica ua>
- fixed mod_proxy security issue; thanks to Dmitry Levin (ldv@) for
alert/patch. Details at http://www.guninski.com/modproxy1.html - fixed "forced localhost" problem (#4235) -- forward-ported the missing part
from previous initscripts (irrelevant for M22 build) - RA to PL30.20 (small Referer-related httpd.conf-dist fixes only)
- fixed ALM2.2 build (release inconsistency barring installation)
- for secfix list see -alt1 changelog record
- 1.3.31 (security fixes for: CAN-2003-0020, CAN-2003-0987, CAN-2004-0174,
CAN-2003-0993) - updated mod_ssl/EAPI to 2.8.17 (for 1.3.31)
- updated RA patch to PL30.19 (for 1.3.29)
- updated mod_perl to 1.29 (minor fixes)
- updated patch1
- refreshed build reqs; put perl-DBM to Sisyphus req branch
- fixed thinko in 1.3.29rusPL30.18-alt3's changelog (s/gorev/horror/)
- hopefully fixed #3153, thanks to Dmitry Alexeyev <dmi qnx org ru>
- rebuilt against libdb4.2
- brought back new and improved ugly hack (since perl and rpm compare
1.1701 and 1.27 in different the only right ways)
- clarified service version dependency for Sisyphus build
(#3245; thanks to Andy Gorev (horror@) for investigation) - added missing /usr/lib/perl5/vendor_perl/i386-linux/cgi_to_mod_perl.pod
to mod_perl-doc - rebuilt against recent perl (#3507)
- applied CAN-2003-0020 fix (still not in ASF tree; thanks Dmitry Levin (ldv@)
for implicit notice and PLD CVS for the patch file) - updated EAPI to 2.8.16
- introduced %apache_conf macro (for /path/to/httpd.conf)
- 1.3.29 (major security fixes)
- fixes CAN-2003-0542:
Fix buffer overflows in mod_alias and mod_rewrite which occurred if
one configured a regular expression with more than 9 captures. - 1.3.28rusPL30.18-alt9 didn't really *apply* no_zombies.patch. Oops.
Still 1.3.29 has similar change there so should be fixed either.
- FIX:
appled http://apache.org/dist/httpd/patches/apply_to_1.3.28/no_zombies.patch,
thanks to Alexey Tourbin (at@) and Alexey Chekushkin <alexey chekushkin com>
(should eliminate CGI Zombies with suExec, cgiwrap and others)
- fixed %_sysconfdir/rpm/macros.d/apache (thanks to Alexey Gladkov (legion@)
for proper file this time)
- fixed #3153 (thanks to Sergey Pinaev <dfo antex ru>):
/etc/init.d/httpd::reload() was broken
- added %_sysconfdir/rpm/macros.d/apache (#2463/enhancement);
needed that for different packages for a long time, thanks for
initial contents to Alexey Gladkov (legion@) - removed versioning in perl(mod_perl.pm) provision
- added Provides: perl(mod_perl.pm) to apache-mod_perl
(should probably seperate extra modules to devel
and run proper find-requires?)
- updated buildrequires (fix hasher build)
- fixed old-style initscripts for both httpd and httpd-perl (#2950)
(NB: no changes in Sisyphus initscripts) - s,/usr/local/apache,/etc/httpd,g in manpages (TODO)
- changed startup/shutdown order from "85 15" to "81 14" in
httpd-perl initscripts so that it starts close after httpd (80)
and stops just before it (15). This fixes spurious message due
to #2928 fix (the problem didn't manifest but was here).
- please see changelog for 1.3.28rusPL30.18-alt1
as more important changes are there - commented out AddModule mod_charset.c in default config (#2941)
(in fact, "CharsetDisable On" already keeps it off, but server
tag would still mention RA and confuse some curious users) - moved (thanks to pilot@ for notice):
* /etc/rc.d/init.d/httpd and /usr/sbin/apachectl
from apache-common to apache
* /usr/sbin/apachectl-perl
from apache-common to apache-mod_perl - /var/log/httpd permissions changed (#2920)
from 3770,root,apache
to 750,root,webmaster - /var/cache/httpd permissions changed (#2921)
from 750,apache_user,webmaster
to 2770,root,apache - apache.logrotate cleanup/fix:
* changed "service httpd reload" to use condreload
* changed create mode from 0664 root.apache to 0644 root.apache - httpd.init.Sisyphus now checks for some situations involving httpd-perl
when silent breakage could occur and issues warnings (#2928) - spec cleanup:
* switched Url from http://apache.lexa.ru to http://httpd.apache.org:
focus isn't on RA anymore (left in index.shtml.ru* though)
* s|%_var/cache|%_cachedir|g and similar macro updates
(ALM2.2 compatible)
* removed osolete comment-outs:
+ 1.3.23's mod_proxy dance
+ specific treatment of mod_include (generic by now)
+ Obsoletes: secureweb-devel from devel subpackage
- 1.3.28 / RA 30.18
- Major Bugfixes (TM)
- WARNING: VU#379828 (addressed) is suspected to be exploitable
- updated EAPI to 2.8.15
- fixed mod_long_name problem in apxs (by Denis Ovsienko <pilot@>;
updated to 1.3.28 and merged into Patch1) - added %add_findprov_lib_path
- APACHE_HEADER_INSTALL=1 now (#917, #2373)
- workaround for careless: %config(noreplace) /var/www/html/*html*
(#1067, #2510; see also bug comments for proper solution) - fixed includedir substitution for apxs-perl (#1254)
- *major* revamp of mime.types file (#1331, #2468, #2848)
(also moved 'application/x-tar' entry there from httpd.conf) - implemented autodetected / manual distro setting to package initscripts
for both ALM2.2 (maintenance builds) and Sisyphus (implementation based
somewhat on aureal-std-up.spec by Alexey Morozov <morozov novosoft ru>) - /etc/httpd/conf/httpd.conf::DirectoryIndex += index.rbx
- spec cleanup:
* updated BuildRequires
* fixed Source1 URL typo
* proper %SOURCEs instead of poking around in RPM_SOURCE_DIR (%install)
- Replaced mdk-mkstemp patch with openbsd-tmp, better optimized one.
- rebuild with new perl
- /etc/rc.d/init.d/httpd: use full path (/usr/sbin/httpd).
- /var/log/httpd: changed permissions to %attr(3770,root,apache).
- /etc/logrotate.d/apache: added directives:
+ sharedscripts;
+ create 0664 root apache.
- Fixed:
+ access rights for /var/www/icons/small
- Security update 1.3.27
- Updated:
+ mod_proxy has been updated to 1.3.27 as well (passes same test suite as 1.3.23's one)
+ mod_perl to 1.27
+ EAPI to 2.8.10 (fixed to be compatible with 1.3.27)
- fixed permisions in mod_perl subpackage
- Fixed:
+ Apache httpd: vulnerability with chunked encoding (next round)
+ Fix RA patch to suit chunked fixes
+ explicit TMPDIR=/tmp
- Fixed:
+ Apache httpd: vulnerability with chunked encoding
- Fixed db4 build support.
- Build with db4.
- Build without bind-devel.
- Updated:
+ EAPI up to 2.8.7 [fixed potential buffer overflow in mod_ssl]
- Fixed:
+ Configure option SHARED_CORE rule must be exclusive
for non-mod_perl Apache only (#0000644)
+ Changed (finally) links and logo to ALT Linux
- Added:
+ SHARED_CORE (libhttpd.so) for Kylix2 Enterprise compatibility - Reverted:
+ mod_proxy to 1.3.22 state (includes partial EAPI revert) - spec clean ups
- Fixed:
+ return codes for 'status' in service scripts
- 1.3.23 / RA 30.11 / EAPI 2.8.6
- APXS moved to apache-common
- Fixed:
+ Non-blocked CharsetDisable directive in httpd.conf (#0000441)
- Fixed:
+ mod_proxy bug (Andrey Orlov)
- Fixed:
+ httpd-perl.conf: Multi language documentation
+ httpd-perl.conf: server side parsed html
+ httpd-perl.conf: enabled mod_negotiation in non-proxied mode
- 1.3.22
- Russian Apache PL30.9
- EAPI 2.8.5
- Fixed start up scripts to use sed/tr (PR #0000093)
- Fixed start up script for mod_perl (PR #0000036)
- Fixed typo in Russian summary for mod_perl (PR #0000057)
- Removed duplicated entry of /etc/httpd/conf/addon-modules/proxied_handlers.pl
from apache-common subpackage. - Built with db3-3.3.11.
- New RA patch
- New mod_perl
- Rebuilt with new perl.
- Rebuilt with perl-5.6.1
- Fixed permissions on /var/www/html.
- Fixed permissions in /var/www.
- Updated init and %post/%preun scripts.
- New Apache version
- Updated:
+ EAPI - 2.8.4
+ CharsetDisable On is set by default - Fixed:
+ initial fix for permissions in /var/www
+ dependency for apache-suexec fixed
- Introducing EAPI to Apache+mod_perl build
- Fixed:
+ logrotate now uses /sbin/service to access httpd and httpd-perl control scripts
- Disabling expat again
- Updated:
+ SGI patches took out due unsupported state and many conflicts with 1.3.19
+ httpd.conf (SingleListen unsupported now) - Fixed:
+ Apache owner/group are apache/apache, not nobody/nobody for httpd.conf/httpd_perl.conf
- Updated:
+ EAPI 2.8.1
+ RA PL30.4 - Fixed:
+ index.php3 added to the set of index files
+ README.EAPI added to apache-common documentation
+ Use system-wide Expat library
- Updated:
+ new Apache version
+ 10xpatch ported to 1.3.19 as well as some other patches which were out of sync with Apache source
- Fixed:
+ logrotate for Apache
+ Documentation for mod_perl - Updated:
+ mod_perl up to 1.25 - Removed:
+ automatic Apache start
- Updated:
+ Official Russian Apache PL30.3 - Fixed
+ SGI patch
+ buffered logs
+ Fallback to mod_perl 1.24_01
+ Symlinks to manual
- Updated:
+ EAPI 2.8.0
+ mod_perl 1.25 - Added:
+ fix for insecure tempfile creation in htpasswd and htdigest,
by Vincent Danen, Mandrakesoft
- Typo fix in httpd.conf
- ra_powered.gif
- Port to 1.3.17, most patches refreshed
- new httpd.init, http-perl.init
- Added:
+ auto-dependencies (provides) built for perl - Updated:
+ new, super-robust apxs patch
+ updated init script
+ minor fixes in httpd.conf, protected httpd-perl status from the outside
+ cleaned up spec, ru -> ru_RU.KOI8-R
+ provides pseudo-package 'russian-apache' including patchlevel
- ported 10xpatch for 1.3.14
- changed mod_log_config_buffered patch to apply at the prep stage
- Thee experimental PL30.0
- Apache 1.3.14, EAPI 2.7.1, mod_rewrite patch
- used the last Russian patch considered to be stable (PL30.0 pending)
- applied 10xpatch for 1.3.12 after JMD has tweaked it down
- changed the document root to /var/www, drifting with the RedHad/Mandrake herd
- overhauled config files
- Added KOffice mimetypes
- separate release number for mod_perl-doc
- index.html.ru.* were added to sources, so I revoked my humble one.
- the last release before Apache 1.3.14 (waiting for 10xpatch)
- mod_perl 1.24_01
- compiled against perl without largefile support
- mod_perl-doc package
- brought configtest command back to apachectl/init script
- merged a bunch of JMD's changes at 1.3.12-30mdk
- added an "official" index.html.ru taken from apache 2.0alpha6
and slightly modified - configure without layout using macros supplied by rpm
- macros everywhere
- fixed install script problems and paths
- new Russian Apache version (further POST fixes) and mm 1.1.3
- new version (the patch added in my previous release has been applied)
- applied a patch by Viktor Khimenko fixing a bug in charset_bread
- disabled EXPAT rule for both servers. PHP 4 builds with its bundled Expat,
no questions asked - EAPI 2.6.5
- disabled EXPAT rule for apache+mod_perl static build to avoid conflicts
with XML::Parser
- new EAPI, MM and mod_perl versions
- Frontpage and XSSI dropped
- rebuilt against Perl having largefile support stripped
- MM lockfiles sit better in /var/lock
- fixes to build under an ordinary user
- filelist cleanup
- sync with 1.3.12-10mdk
- mm thrown out to be a separate package
- moved apxs from devel to common -- the tool is too useful
- mod_perl 1.22. Still leaks memory on restarts being a DSO.
- Russian Apache 1.3.12 rusPL29.4
- Jean-Michel's add-ons merged back
- SGI patches for 1.3.12 (up to level 1) applied
- index.html.ru translated to Russian :)
- cleaned out apxs
- fixed ServerRoot for good
- fixed MM lockfile path
- added -n mod_perl package for punks
- updated to Russian Apache 1.3.9 rusPL29.2
- fixed .packlist for mod_perl
- ported to Russian Apache PL28.22
- added a version with mod_perl 1.21 linked in
- moved files common for apache and apache-mod_perl to apache-common
- EAPI 2.4.10
- mm and mm-devel are now separate packages too
- most of other add-ons dropped (sorry pals)
- moved suexec to another package so it doesn't get installed by default
- added index.php3 as valid index.
- final cleanup for Mandrake 7