Security issue reporter acknolowedgements?

2006-04-07 Thread William A. Rowe, Jr.
I just noticed with the mass of vulnerability reports, we threw in just a blanket thank you to the reporters for 2.0.55, and should go back and adjust that for posterity, e.g. as we had in this version; https://svn.apache.org/viewcvs.cgi/httpd/httpd/dist/Announcement2.txt?rev=105304&view=markup

Re: [VOTE] Release 2.2.1 as GA

2006-04-07 Thread Jorge Schrauwen
On 4/7/06, William A. Rowe, Jr. <[EMAIL PROTECTED]> wrote: Jorge Schrauwen wrote:> Interesting, i'll give it another shot later today, 2.2.0 was comply> totaled if trying as Win64.Yup, mostly hopeless back then.> Making 2.0 Win64 compatible is to mutch work IMHO. > Focusing on 2.2 is a great idea..

Re: [VOTE] Release 2.2.1 as GA

2006-04-07 Thread Jorge Schrauwen
On 4/7/06, William A. Rowe, Jr. <[EMAIL PROTECTED]> wrote: > Making 2.0 Win64 compatible is to mutch work IMHO.> Focusing on 2.2 is a great idea...Couple observations; pcre is quite LP64 dirty; this is observed underdarwin x686 and win64.  so don't necessarily expect 2.2.1 to build win64clean yet

Re: [VOTE] Release 2.2.1 as GA

2006-04-07 Thread Steffen
I do not have the issue (now 3 reports at the Apachelounge), so I cannot give more info, here it was working fine. I build now with openssl 0.9.8b instead of 0.9.8a. And suprise, it is working now at that guys. I come back here when there are still issues. Steffen - Original Message -

RE: Mod_proxy_http ProxyErrorOverride eating cookies

2006-04-07 Thread Jeff Tharp
Bart, How about we tag-team on this one :-) I may not be able to create a patch to fix it, but I can certainly fill out a web form. I submitted this as bug ID #39245 along with the copying the email exchanges we've had on the list. You might want to add yourself to the cc for this. Folks, I'm

Re: [VOTE] Release 2.2.1 as GA

2006-04-07 Thread William A. Rowe, Jr.
Jorge Schrauwen wrote: Interesting, i'll give it another shot later today, 2.2.0 was comply totaled if trying as Win64. Yup, mostly hopeless back then. Making 2.0 Win64 compatible is to mutch work IMHO. Focusing on 2.2 is a great idea... Couple observations; pcre is quite LP64 dirty; this i

Re: [VOTE] Release 2.2.1 as GA

2006-04-07 Thread William A. Rowe, Jr.
Joost de Heer wrote: Steffen wrote: So far I have two reports that mod_ssl is given issues. Strange, I tried it on three XP boxes and all is fine. The report is: error c005 at 6FD0F220 (mod_ssl). c005 is 'access violation'. Using FileMon, this appears to get triggered when trying to

Re: [VOTE] Release 2.2.1 as GA

2006-04-07 Thread Joost de Heer
Steffen wrote: So far I have two reports that mod_ssl is given issues. Strange, I tried it on three XP boxes and all is fine. The report is: error c005 at 6FD0F220 (mod_ssl). c005 is 'access violation'. Using FileMon, this appears to get triggered when trying to read in a server cert

Re: [VOTE] Release 2.2.1 as GA

2006-04-07 Thread Jorge Schrauwen
Strange my SSL vhosts works fine.Don't get any errors.On 4/7/06, Steffen <[EMAIL PROTECTED]> wrote: So far I have two reports that mod_ssl is given issues.Strange, I tried it on three XP boxes and all is fine. The report is:error c005 at 6FD0F220 (mod_ssl).c005 is 'access violation'.Using F

Re: [VOTE] Release 2.2.1 as GA

2006-04-07 Thread Jorge Schrauwen
Interesting, i'll give it another shot later today, 2.2.0 was comply totaled if trying as Win64.Making 2.0 Win64 compatible is to mutch work IMHO.Focusing on 2.2 is a great idea...I noted that i didn't have any SDK's installed because if you use the free edition of VC.net 2005 you need Platform SD

Re: [VOTE] Release 2.2.1 as GA

2006-04-07 Thread Steffen
So far I have two reports that mod_ssl is given issues. Strange, I tried it on three XP boxes and all is fine. The report is: error c005 at 6FD0F220 (mod_ssl). c005 is 'access violation'. Using FileMon, this appears to get triggered when trying to read in a server certificate. I removed

Re: svn commit: r392234 - in /httpd/site/trunk: docs/security/vulnerabilities_13.html xdocs/security/vulnerabilities-httpd.xml

2006-04-07 Thread William A. Rowe, Jr.
[EMAIL PROTECTED] wrote: Author: mjc Date: Fri Apr 7 02:58:47 2006 New Revision: 392234 URL: http://svn.apache.org/viewcvs?rev=392234&view=rev Log: Revert revision 392230. wrowe correctly points out that cve-2005-2088 didn't affect apache 1.3, and indeed I've mailed people that thought it di

Re: [VOTE] Release 2.2.1 as GA

2006-04-07 Thread William A. Rowe, Jr.
Jorge Schrauwen wrote: Compiler: Visual Studio .net 2005 Pro (out of box, no aditianal SDK's) FWIW, I'm focused on the Win64 fixes on trunk, backporting compatible changes to 2.2, and ignoring 2.0 for Win64. Of course you don't need any SDK's - they are included. For VS 6.0 users their heade

Re: svn commit: r392230 - in /httpd/site/trunk: docs/security/vulnerabilities_13.html xdocs/security/vulnerabilities-httpd.xml

2006-04-07 Thread Mark J Cox
> 1.3 was UNAFFECTED Yes, indeed it was me that insisted that this didn't affect 1.3, I'll revert it :) Cheers, Mark

Re: svn commit: r392230 - in /httpd/site/trunk: docs/security/vulnerabilities_13.html xdocs/security/vulnerabilities-httpd.xml

2006-04-07 Thread William A. Rowe, Jr.
WHY? 1.3 was UNAFFECTED by the original report, because chunking is NOT SUPPORTED. The only reason I insisted on fixing it is that there were other similar issues w.r.t. other handlers. I thought you were the one who insisted that my patch didn't address -2088? It' Bill [EMAIL PROTECTED] wro

Re: [VOTE] Release 2.2.1 as GA

2006-04-07 Thread Jorge Schrauwen
> Done.>> I build against APR and APR-util 1.3.0 and the Perl scripts working now.> > Also no build error apu_version anymore.> > All tests passed here, including mod_perl and other common mods. > > Steffen> > http://www.apachelounge.comYeah it builds fine with APR and APR-util trunk, nothing was