Project description.

The Apache HTTP Server Project is an effort to develop and maintain an open-source HTTP server for modern operating systems including UNIX and Windows NT.

The goal of this project is to provide a secure, efficient and extensible server that provides HTTP services in sync with the current HTTP standards

Apache 2.2.1 Changelog
  • SECURITY: CVE-2005-3357 (cve.mitre.org) mod_ssl: Fix a possible crash during access control checks if a non-SSL request is processed for an SSL vhost (such as the "HTTP request received on SSL port" error message when an 400 ErrorDocument is configured, or if using "SSLEngine optional"). PR 37791. [Rüdiger Plüm, Joe Orton]
  • SECURITY: CVE-2005-3352 (cve.mitre.org) mod_imagemap: Escape untrusted referer header before outputting in HTML to avoid potential cross-site scripting. Change also made to ap_escape_html so we escape quotes. Reported by JPCERT. [Mark Cox]
  • mod_proxy_ajp: Flushing of the output after each AJP chunk is now configurable at runtime via the 'flushpackets' and 'flushwait' worker params. Minor MMN bump. [Jim Jagielski]
  • mod_proxy: Fix incorrect usage of local and shared worker init. PR 38403. [Jim Jagielski]
  • mod_isapi: Fix compiler errors on Unix platforms. [William Rowe]
  • mod_proxy_http: Do send keep-alive header if the client sent connection: keep-alive and do not close backend connection if the client sent connection: close. PR 38524. [Ruediger Pluem, Joe Orton]
  • mod_disk_cache: Return the correct error codes from bucket read failures, instead of APR_EGENERAL. [Brian Akins ]
  • Add APR/APR-Util Compiled and Runtime Version numbers to the output of 'httpd -V'. [William Rowe]
  • http: If a connection is aborted while waiting for a chunked line, flag the connection as errored out. [Justin Erenkrantz]
  • core: Reject invalid Expect header immediately. PR 38123. [Ruediger Pluem]
  • Fix mis-shifted 32 bit scope, masked to 64 bits as a method. [Will Rowe, Joe Orton]
  • mod_proxy: Fix KeepAlives not being allowed and set to backend servers. PR 38602. [Ruediger Pluem, Jim Jagielski]
  • Fix instdso.sh "sed syntax error" installation issue on some platforms. PR 38108. [Masaoki Kobayashi ]
  • mod_ssl: Fix possible crashes in shmcb with gcc 4 on platforms requiring word-aligned pointers. PR 38838. [Joe Orton]
  • mod_proxy: If we get an error reading the upstream response, close the connection. [Justin Erenkrantz, Roy T. Fielding, Jim Jagielski, Ruediger Pluem]
  • mod_proxy_ajp: Support common headers of the AJP protocol in responses. PR 38340. [Aleksey Pesternikov ]
  • mod_proxy_balancer: Do not overwrite the status of initialized workers and respect the configured status of uninitilized workers when creating a new child process. [Ruediger Pluem]
  • mod_proxy_ajp: Crosscheck the length of the body chunk with the length of the ajp message to prevent mod_proxy_ajp from reading beyond the buffer boundaries and thus revealing possibly sensitive memory contents to the client. [Ruediger Pluem]
  • Ensure that the proper status line is written to the client, fixing incorrect status lines caused by filters which modify r->status without resetting r->status_line, such as the built-in byterange filter. [Jeff Trawick]
  • mod_speling: Stop crashing with certain non-file requests. [Jeff Trawick]
  • mod_cache: Make caching of reverse proxies possible again. PR 38017. [Ruediger Pluem]
  • Modify apr[util] .h detection to avoid breakage on VPATH builds using Solaris make (amoung others) and avoid breakage in ./buildconf when srclib/apr[-util] are symlinks rather than directories proper. [William Rowe]
  • Avoid Server-driven negotiation when a script has emitted an explicit Status: header. PR 38070. [Nick Kew]
  • Fix to avoid feeding C99 to C++ compilers. [Joe Orton]
  • Chunk filter: Fix chunk filter to create correct chunks in the case that a flush bucket is surrounded by data buckets. [Ruediger Pluem]
  • Fix syntax error in httpd.h with strict compilers. PR 37840. [Per Olausson ]
  • Fix recursive ErrorDocument handling. PR 36090. [Chris Darroch ]
  • Don't hang on error return from post_read_request. PR 37790. [Nick Kew]
  • Fix off-by-one error in proxy_balancer. PR 37753. [Kazuhiro Osawa ]