[ANNOUNCE] mod_perl 1.30

[Philippe M. Chiasson]

The URL

  http://apache.org/dyn/closer.cgi/perl/mod_perl-1.30.tar.gz
  or

http://www.perl.com/CPAN/modules/by-module/Apache/ mod_perl-1.30.tar.gz

has entered CPAN as

  file: $CPAN/authors/id/G/GO/GOZER/mod_perl-1.30.tar.gz
  size: 389029 bytes
   md5: bfd6f6cff1ab1cc3dbb58a236701d169

This release is a security release.

This is the first release in a long while, and even though it was
triggered by an important security issue,a it also includes a good
collection of bug fixes, so upgrading is doubly a good idea!

URL regular expression DoS (CVE-2007-1349)





Changes since 1.29:

SECURITY: CVE-2007-1349 (cve.mitre.org)
fix unescaped variable interpolation in Apache::PerlRun
regular expression to prevent regex engine tampering.
reported by Alex Solovey


sync Apache-SizeLimit with latest version from CPAN (0.91)
[Philip M. Gollucci, Philippe M. Chiasson]

Fix an Apache::(Registry|PerlRun) bug caused by special characters
in the url [EMAIL PROTECTED]

Display a more verbose message if Apache.pm can't be loaded
[Geoffrey Young]

Fix incorrect win32 detection in Apache::SizeLimit reported by
Matt Phillips <[EMAIL PROTECTED]> [Philippe M. Chiasson]

The print-a-scalar-reference feature is now deprecated and documented
as such [Stas]


[Geoffrey Young]

for some reason .pm files during the modperl build see $ENV{PERL5LIB}
set in Makefile.PL, which is used for generating Makefiles, as
"PERL5LIB=/path:/another/path" instead of "/path:/another/path"
essentially rendering this env var useless. I'm not sure why, may be
MakeMaker kicks in somewhere. Trying to workaround by
s/PERL5LIB/PERL5LIB_ENV/, using anything that's not PERL5LIB. [Stas]

change $INC{$key} = undef; to delete $INC{$key}; in PerlFreshRestart
[Geoffrey Young]

Fix a bug in Makefile.PL for Win32 where it would, in
certain cases, pick up the wrong Perl include directory
[Steve Hay]

------------------------------------------------------------------------
Philippe M. Chiasson     GPG: F9BFE0C2480E7680 1AE53631CB32A107 88C3A5A5
http://gozer.ectoplasm.org/       m/gozer\@(apache|cpan|ectoplasm)\.org/

A flaw was discovered in the Apache::PerlRun module shipped with mod_perl 1.29 and earlier and in the ModPerl::RegistryCooker module shipped with mod_perl 2.03 and earlier. A remote attacker could craft a URL with a path that would be interpreted as a regular expression, potentially allowing a denial of service by creating an expression that will take a very long time to run. This vulnerability only affects Apache::PerlRun and custom subclasses of ModPerl::RegistryCooker that explicitly use the namespace_from_uri() method. The Apache::Registry, ModPerl::PerlRun, and ModPerl::Registry modules are NOT affected. Users of mod_perl 1.29 and earlier are encouraged to upgrade to 1.30 if they use Apache::PerlRun for their applications. [Randal L. Schwartz <merlyn@stonehenge.com>, Fred Moyer <[EMAIL PROTECTED]>] fix "PerlSetVar Foo 0" so that $r->dir_config('Foo') returns 0, not undef

PGP.sig
Description: This is a digitally signed message part