# changelog

author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-94
changelog:
  - Resolves: #1565491 - CVE-2017-15715 httpd: <FilesMatch> bypass with a trailing
    newline in the file name
  - Resolves: #1747283 - CVE-2019-10098 httpd: mod_rewrite potential open redirect
  - Resolves: #1724879 - httpd terminates all SSL connections using an abortive
    shutdown
  - Resolves: #1715981 - Backport of SessionExpiryUpdateInterval directive
  - Resolves: #1565457 - CVE-2018-1303 httpd: Out of bounds read in
    mod_cache_socache can allow a remote attacker to cause a denial of service
  - Resolves: #1566531 - CVE-2018-1283 httpd: Improper handling of headers in 
    mod_session can allow a remote user to modify session data for CGI applications


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-97
changelog:
  - Resolves: #1852350 - httpd/mod_proxy_http/mod_ssl aborted when sending
    a client cert to backend server
  - Resolves: #1785100 - mod_cgid takes CGIDScriptTimeout x 2 seconds for timeout
  - Resolves: #1862499 - Intermittent Segfault in Apache httpd due to pool
    concurrency issues


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.1
changelog:
  - Resolves: #2011729 - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted
    request uri-path containing "unix:"


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.3
changelog:
  - Resolves: #2035058 - CVE-2021-44790 httpd: mod_lua: possible buffer overflow
    when parsing multipart content


author: Luboš Uhliarik <luhliari@redhat.com>
changelog:
  - Resolves: #2031072 - CVE-2021-34798 httpd: NULL pointer dereference via
    malformed requests
  - Resolves: #2031074 - CVE-2021-39275 httpd: out-of-bounds write in
    ap_escape_quotes() via malicious input
  - Resolves: #1969226 - CVE-2021-26691 httpd: Heap overflow in mod_session


author: CentOS Sources <bugs@centos.org> - 2.4.6-97.el7.centos.4
changelog:
  - Remove index.html, add centos-noindex.tar.gz
  - change vstring
  - change symlink for poweredby.png
  - update welcome.conf with proper aliases


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.5
changelog:
  - Resolves: #2065243 - CVE-2022-22720 httpd: HTTP request smuggling
    vulnerability in Apache HTTP Server 2.4.52 and earlier


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.6
changelog:
  - Resolves: #2101997 - HEAD request with a 404 and custom ErrorPage causes
    corrupt and mixed-up responses


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.7
changelog:
  - Resolves: #2177742 - CVE-2023-25690 httpd: HTTP request splitting with
    mod_rewrite and mod_proxy


author: Joe Cooper <joe@virtualmin.com> - 2.19-1
changelog:
  - Update to 2.19
  - Apply patch and changes suggested in https://bugzilla.redhat.com/show_bug.cgi?id=967782
  - setcap on jk_chrootsh with %caps macro


author: Joe Cooper <joe@virtualmin.com> - 2.19-1
changelog:
  - Update to 2.19
  - Apply patch and changes suggested in https://bugzilla.redhat.com/show_bug.cgi?id=967782
  - setcap on jk_chrootsh with caps macro


author: Paul Howarth <paul@city-fan.org> 2.3.4-2
changelog:
  - Add fixes from upstream svn for a number of issues, most notably that the
    fixconf script had an error in the regexp, which resulted in a prefix of
    "FcgidFcgid" on the updated directives


author: Paul Howarth <paul@city-fan.org> 2.3.6-1
changelog:
  - Update to 2.3.6 (see CHANGES-FCGID for full details)
    - Fix possible stack buffer overwrite (CVE-2010-3872)
    - Change the default for FcgidMaxRequestLen from 1GB to 128K; administrators
      should change this to an appropriate value based on site requirements
    - Correct a problem that resulted in FcgidMaxProcesses being ignored in some
      situations
    - Return 500 instead of segfaulting when the application returns no output
  - Don't include SELinux policy for RHEL-5 builds since RHEL >= 5.5 includes it
  - Explicitly require /bin/sed for fixconf script


author: Paul Howarth <paul@city-fan.org> 2.3.6-2
changelog:
  - Add /etc/tmpfiles.d/mod_fcgid.conf for builds on Fedora 15 onwards to
    support running with /var/run on tmpfs (#656625)


author: Paul Howarth <paul@city-fan.org> 2.3.6-5
changelog:
  - Fix regression in 2.3.6 that broke process controls when using vhost-specific
    configuration (upstream issue 49902, #783742, CVE-2012-1181)


author: Paul Howarth <paul@city-fan.org> 2.3.6-6
changelog:
  - Fix compatibility with httpd 2.4 in F-18/RHEL-7 onwards
  - Use /run rather than /var/run from F-15/RHEL-7 onwards


author: Paul Howarth <paul@city-fan.org> 2.3.7-1
changelog:
  - Update to 2.3.7
    - Introduce FcgidWin32PreventOrphans directive on Windows to use OS Job
      Control Objects to terminate all running fcgi's when the worker process
      has been abruptly terminated (PR: 51078)
    - Periodically clean out the brigades that are pulling in the request body
      for handoff to the fcgid child (PR: 51749)
    - Resolve crash during graceful restarts (PR: 50309)
    - Solve latency/congestion of resolving effective user file access rights
      when no such info is desired, for config-related filename stats (PR: 51020)
    - Fix regression in 2.3.6 that broke process controls when using
      vhost-specific configuration
    - Account for first process in class in the spawn score
  - Drop patch for CVE-2012-1181, now included in upstream release


author: Paul Howarth <paul@city-fan.org> - 2.27202-1
changelog:
  - Update to 2.27202
    - Fix test failures due to hash iterator randomization in perl 5.17.6 onwards
      (CPAN RT#83421)


author: Paul Howarth <paul@city-fan.org> - 2.27300-1
changelog:
  - Update to 2.27300
    - Fixed a problem about substr in perl 5.8.6 and below
  - Classify buildreqs by usage


author: Paul Howarth <paul@city-fan.org> - 2.007-1
changelog:
  - Update to 2.007
  - BR: perl(Test::More) and perl(Time::HiRes)
  - Add various other buildreqs for additional test coverage
  - Don't use macros for commands
  - Don't need to remove empty directories from the buildroot
  - Drop %defattr, redundant since rpm 4.4
  - Use DESTDIR rather than PERL_INSTALL_ROOT


author: Dmitry Butskoy <Dmitry@Butskoy.name> - 5.1.6-5
changelog:
  - add pdo_dblib module for php-mssql
  - add php-interbase support (both interbase and pdo_firebird modules)
    (initial patch from Remi Collet <fedora@famillecollet.com>)


author: Dmitry Butskoy <Dmitry@Butskoy.name> - 5.3.2-3
changelog:
  - drop readline (now in the main php package)
  - drop mhash (no more provided in php, hash used instead)
  - spec file cleanup


author: Remi Collet <rcollet@redhat.com> - 5.4.16-1
changelog:
  - add interbase
  - add workaround for https://bugzilla.redhat.com/1054659
  - minimal load test for all extensions


author: Christopher Meng <rpm@cicku.me> - 1.34-9
changelog:
  - Update systemd service unit to be more powerful.
  - SPEC cleanup(BZ#850279).
  - Add missing dependencies(BZ#1039355).


author: Paul Howarth <paul@city-fan.org> 1.3.5-1
changelog:
  - Update to 1.3.5 (see NEWS for details)
  - Drop upstreamed patches
  - Drop sysv-to-systemd migration script
  - No longer need to support pam_stack


author: Paul Howarth <paul@city-fan.org> 1.3.5-2
changelog:
  - Add upstream fix to ignore any ENOPROTOOPT errors when setting the
    IPv6 TCLASS (TOS) flags on the socket; they make for noisier logging
    without providing any actual value to the user/admin (upstream bug 4055)


author: Paul Howarth <paul@city-fan.org> - 1.3.5-4
changelog:
  - Anonymous upload directory specification needs to be slightly different if
    mod_vroot is in use (#1045922)
    http://sourceforge.net/p/proftp/mailman/message/31728570/
  - Use %license where possible


author: Paul Howarth <paul@city-fan.org> - 1.3.5-5
changelog:
  - Unauthenticated copying of files via SITE CPFR/CPTO was allowed by mod_copy
    (CVE-2015-3306, http://bugs.proftpd.org/show_bug.cgi?id=4169)


author: Paul Howarth <paul@city-fan.org> - 1.3.5a-1
changelog:
  - Update to 1.3.5a
    - Fixed "stalled" SSL/TLS handshakes for data transfers
    - Fixed handling of SSH keys with overlong Comment headers in mod_sftp_sql
    - By default, mod_tls will no longer support SSLv3 connections; in order to
      support SSLv3 connections (for sites that need to), you must explicitly
      configure this via the TLSProtocol directive, e.g.:
      TLSProtocol SSLv3 TLSv1 ...
    - The mod_copy module is enabled by default; there may be cases where the
      module should be disabled, without requiring a rebuild of the server, thus
      mod_copy now supports a CopyEngine directive to enable/disable the module
    - The DeleteAbortedStores directive (for Bug#3917) is only enabled when
      HiddenStores is in effect, as intended when originally implemented, rather
      than all the time
    - Many other bug-fixes, see NEWS for details
  - Drop upstreamed patches


author: Paul Howarth <paul@city-fan.org> - 1.3.5a-2
changelog:
  - Avoid unbounded SFTP extended attribute key/values
    (#1286977, http://bugs.proftpd.org/show_bug.cgi?id=4210)


author: Paul Howarth <paul@city-fan.org> - 1.3.5b-1
changelog:
  - Update to 1.3.5b
    - mod_geoip did not load all of the GeoIPTables properly (upstream bug 4187)
    - "Incorrect string value" reported by mod_sql_mysql for some UTF8 characters
      (upstream bug 4191)
    - SSH rekey failed when using RSA hostkey smaller than 2048 bits
      (upstream bug 4097)
    - MLSD/MLST fact type "cdir" is incorrectly used for the current working
      directory (upstream bug 4198)
    - HiddenStores temporary files not removed when exceeding quota using SCP
      (upstream bug 4201)
    - MLSD lines not properly terminated with CRLF (upstream bug 4202)
    - Zero-length memory allocation possible, with undefined results
      (upstream bug 4209)
    - Avoid unbounded SFTP extended attribute key/values (upstream bug 4210)
    - Ensure that FTP data transfer commands fail appropriately when
      "RootRevoke on" is in effect (upstream bug 4212)
    - Handle FTP re-authentication attempts better (upstream bug 4217)
    - Permissions on files uploaded via STOU did not honor configured Umask
      (upstream bug 4223)
    - Support SFTP clients that send multiple INIT requests (upstream bug 4227)
    - TLSDHParamFile directive appears ignored because unexpected DH is chosen
      (upstream bug 4230)
  - Drop unbundled old version of mod_geoip
  - Drop upstreamed patches


author: Paul Howarth <paul@city-fan.org> - 1.3.5b-2
changelog:
  - Handle client/server version skew in mod_sql_mysql
    (https://forums.proftpd.org/smf/index.php?topic=11887.0)
  - Fix a possible cause of segfaults in mod_sftp (#1337880, upstream bug 4203)
  - See if we can fix crash in mod_lang
    http://bugs.proftpd.org/show_bug.cgi?id=4206
    https://retrace.fedoraproject.org/faf/reports/10744/
  - BR: perl-generators for correct dependencies in utils sub-package
  - Prefer %global over %define


author: Paul Howarth <paul@city-fan.org> - 1.3.5d-1
changelog:
  - Update to 1.3.5d
    - Support OpenSSL 1.1.x API (upstream bug 4275)
    Bug fixes:
    - SSH rekey during authentication can cause issues with clients
      (upstream bug 4254)
    - Recursive SCP uploads of multiple directories not handled properly
      (upstream bug 4257)
    - LIST returns different results for file, depending on path syntax
      (upstream bug 4259)
    - "AuthAliasOnly on" in server config breaks anonymous logins
      (upstream bug 4255)
    - CapabilitiesEngine directive not honored for <IfUser>/<IfGroup> sections
      (upstream bug 4272)
    - Memory leak when mod_facl is used (upstream bug 4278)
    - All FTP logins treated as anonymous logins again (upstream bug 4283,
      regression in 1.3.5c of upstream bug 3307)


author: Paul Howarth <paul@city-fan.org> - 1.3.5d-2
changelog:
  - Properly allocate (and clear) the UMAC contexts, to fix segfault in mod_sftp
    (#1420365, upstream bug 4287)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.6-2
changelog:
  - Fixed milter_helo regression (milter-helo-fix patch)
    Resolves: rhbz#895552
  - Fixed bogus dates in changelog


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.7-5
changelog:
  - Explicitly enabled sm-client statistics
    Resolves: rhbz#890585
  - Enable ECDHE support
    Resolves: rhbz#1124827
  - Properly set {client_port} value on little endian machines,
    patch by Kelsey Cumminngs <kgc@corp.sonic.net>
    Resolves: rhbz#1210914
  - Added makemap and its manual page into alternatives
    Resolves: rhbz#1225891
  - Modified nm-dispatcher script to asynchronously restart sendmail and
    not block the connection activation
    Resolves: rhbz#1237070
  - Added config options allowing disablement of TLS 1.1/2
    Resolves: rhbz#1281476
  - Fixed problem with e-mails not sending from IPv6 enabled server
    to servers with MX record pointing to CNAME
    Resolves: rhbz#1294870
  - Added editmap
    Resolves: rhbz#1342393
  - Removed systemd limit for sendmail restarts to workaround failure due to
    rapid restarts caused by NetworkManager dispatcher script
    Resolves: rhbz#1395102
  - Fixed op.pdf
    Resolves: rhbz#1401070


author: Joe Cooper <joe@virtualmin.com>
changelog:
  - Moved all distro neutral files into "universal" repo, which should
    save a lot of maintenance time


author: Joe Cooper <joe@virtualmin.com>
changelog:
  - Removed the up2date stuff...we have to use yum
  - Added import of the system RPM-GPG-KEY files, as it causes errors during
    install if we don't have them.


author: Joe Cooper <joe@virtualmin.com>
changelog:
  - Remove legacy cruft for dealing with old yum and up2date
  - Remove key importation of system keys...this is probably understood by users today, where it used to confuse and alarm users during install.


author: Joe Cooper <joe@virtualmin.com>
changelog:
  - Remove locate and updatedb stuff; was more trouble than it was worth
  - Rebuilding for Fedora, among others


