---
- branch: MAIN
  date: Mon Jul 20 00:08:35 UTC 2015
  files:
  - new: '1.37'
    old: '1.36'
    path: pkgsrc/www/apache24/Makefile
    pathrev: pkgsrc/www/apache24/Makefile@1.37
    type: modified
  - new: '1.21'
    old: '1.20'
    path: pkgsrc/www/apache24/distinfo
    pathrev: pkgsrc/www/apache24/distinfo@1.21
    type: modified
  - new: '0'
    old: '1.1'
    path: pkgsrc/www/apache24/patches/patch-CVE-2015-0228
    pathrev: pkgsrc/www/apache24/patches/patch-CVE-2015-0228@0
    type: deleted
  - new: '0'
    old: '1.1'
    path: pkgsrc/www/apache24/patches/patch-server_core__filters.c
    pathrev: pkgsrc/www/apache24/patches/patch-server_core__filters.c@0
    type: deleted
  - new: '0'
    old: '1.1'
    path: pkgsrc/www/apache24/patches/patch-server_protocol.c
    pathrev: pkgsrc/www/apache24/patches/patch-server_protocol.c@0
    type: deleted
  id: 20150720T000835Z.619d73b4cb67bd7945394e5c2e4e1b9f8295f92a
  log: |
    Update apache24 to 2.4.16 (Apache HTTP Server 2.4.16).

            Apache HTTP Server 2.4.16 Released

    The Apache Software Foundation and the Apache HTTP Server Project
    are pleased to announce the release of version 2.4.16 of the Apache
    HTTP Server ("Apache").  This version of Apache is our latest GA
    release of the new generation 2.4.x branch of Apache HTTPD and
    represents fifteen years of innovation by the project, and is
    recommended over all previous releases. This release of Apache is
    principally a security, feature and bug fix release. NOTE: versions
    2.4.13, 2.4.14 and 2.4.15 were not released.

    CVE-2015-3183 (cve.mitre.org)
    core: Fix chunk header parsing defect.
    Remove apr_brigade_flatten(), buffering and duplicated code from
    the HTTP_IN filter, parse chunks in a single pass with zero copy.
    Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext
    authorized characters.

    CVE-2015-3185 (cve.mitre.org)
    Replacement of ap_some_auth_required (unusable in Apache httpd 2.4)
    with new ap_some_authn_required and ap_force_authn hook.

    CVE-2015-0253 (cve.mitre.org)
    core: Fix a crash with ErrorDocument 400 pointing to a local URL-path
    with the INCLUDES filter active, introduced in 2.4.11. PR 57531.

    CVE-2015-0228 (cve.mitre.org)
    mod_lua: A maliciously crafted websockets PING after a script
    calls r:wsupgrade() can cause a child process crash.

    Also in this release are some exciting new features including:

    *) Better default recommended SSLCipherSuite and SSLProxyCipherSuite
    *) mod_proxy_scgi: ProxySCGIInternalRedirect now allows an alternate
    response header to be used by the application
    *) Event MPM improvements
    *) Various mod_proxy_* improvements
    *) mod_log_config: Add "%{UNIT}T" format to output request duration in
    seconds, milliseconds or microseconds depending on UNIT ("s", "ms",
    "us")
  module: pkgsrc
  subject: 'CVS commit: pkgsrc/www/apache24'
  unixtime: '1437350915'
  user: taca