Topic: 2.2.16 status?

[DjiXas]

Hi,

Does anyone know, whether 2.2.16 will be released this month or not?

[glsmith]

Doubt it. Any particular reason?

[DjiXas]

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2068

[glsmith]

Thought that might be it.

If you are using Apache.org binaries
http://www.apache.org/dist/httpd/binaries/win32/mod_proxy_http-CVE-2010-2068.zip

If you are using any VC9 built Apache binary (Apache Lounge, Apache Haus, ??)
http://www.apachehaus.com/
there's a announce with link to download page on the front page of the site

[DjiXas]

Call me an idiot, but I prefer to wait :-)

Thanks, though.

[glsmith]

I wouldn't do that, you have your reasons regardless of my opinion. If you do not use mod_proxy_http, there is no need at this point to even update that module with the CVE fix. If you are running *nix, chances are it has already been fixed and pushed in an update a few weeks ago.

I would like to point out however that this "is" an official release, just in the form of the fixed module instead of an entire server package. The only two changes to this module to date are in there.

There have not been enough other changes to call for a full release, there have only been two others, none of which to the core.

*) mod_ssl: Fix segfault at startup if proxy client certs are shared
across multiple vhosts. PR 39915. [Joe Orton]

*) apxs: Fix -A and -a options to ignore whitespace in httpd.conf
[Philip M. Gollucci]


There are 4 more accepted to backport from trunk soon to be included, none of which to the core. There are 13 more proposed with 0 - 2 votes (requires 3), only 2 require changes to core. None of these possible 17 are vulnerability related changes.

The gears move much slower in the summer, so unless a CVE comes down the road that requires a change to the core, you are probably going to be waiting awhile.

References:
http://httpd.apache.org/security/vulnerabilities_22.html
http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/CHANGES?view=co
http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/STATUS?view=co

[James Blond]

The discussion started http://marc.info/?l=apache-httpd-dev&m=127896116715588&w=2 So let's wait and see what happens.

[DjiXas]

Thanks for the insight, guys!