Re: [RFC] further proxy/rewrite URL validation security issue (CVE-2011-4317)

2012-01-12 Thread Tomas Hoger
Jeff Trawick trawick at gmail.com writes: Tomas Hoger tracked this down to a change to apr_uri_parse(), see here: https://bugzilla.redhat.com/show_bug.cgi?id=756483#c8 The referenced change is in APR-util version 1.2.13, so httpd is not vulnerable if using APR-util 1.2.12 or older

Re: Time for 2.4.0 GA??

2012-01-12 Thread Steffen
We have at least 4 hard bugs in 2.3.16. Known for a long time, and no need to exposure more for these. Fine a GA, with a big note that it is not ready for Windows and advising to run 2.2.21 as proven stable. So not happy with 2.4. Op 11 jan. 2012 om 16:37 heeft Jim Jagielski

Re: Time for 2.4.0 GA??

2012-01-12 Thread Jim Jagielski
On monday (Jan 16th), I plan to TR 2.4.0...

Re: Time for 2.4.0 GA??

2012-01-12 Thread Rainer Jung
On 12.01.2012 11:24, Steffen wrote: We have at least 4 hard bugs in 2.3.16. Known for a long time, and no need to exposure more for these. Fine a GA, with a big note that it is not ready for Windows and advising to run 2.2.21 as proven stable. So not happy with 2.4. Understood, but we

Re: Time for 2.4.0 GA??

2012-01-12 Thread Graham Leggett
On 12 Jan 2012, at 18:10, Jim Jagielski j...@jagunet.com wrote: On monday (Jan 16th), I plan to TR 2.4.0... +1. Let's do this. Regards, Graham --

Re: Time for 2.4.0 GA??

2012-01-12 Thread Steffen
+1 non binding. Please note in the announcement that for Windows there are still issues pending, special not working SSL, hanging workers, balancer and Rewrite Proxy. For production use, is 2.2.21 advised. Op 12 jan. 2012 om 18:10 heeft Jim Jagielski j...@jagunet.com het volgende geschreven:

Re: Time for 2.4.0 GA??

2012-01-12 Thread Rainer Jung
On 12.01.2012 19:10, Jim Jagielski wrote: On monday (Jan 16th), I plan to TR 2.4.0... +1

Re: Time for 2.4.0 GA??

2012-01-12 Thread Gregg L. Smith
On 1/12/2012 10:11 AM, Rainer Jung wrote: On 12.01.2012 11:24, Steffen wrote: We have at least 4 hard bugs in 2.3.16. Known for a long time, and no need to exposure more for these. Fine a GA, with a big note that it is not ready for Windows and advising to run 2.2.21 as proven stable. So

Re: Time for 2.4.0 GA??

2012-01-12 Thread Gregg L. Smith
On 1/11/2012 5:52 PM, Daniel Ruggeri wrote: On 1/11/2012 6:26 PM, Noel Butler wrote: Also, in relation to the windows stuff, I think Jim's suggestion is most appropriate in the absence of more windows users to test. If all we need is testing and some logging, I'd be happy to assist. If someone

Re: Time for 2.4.0 GA??

2012-01-12 Thread Daniel Ruggeri
On 1/12/2012 5:50 PM, Gregg L. Smith wrote: Either apachehaus.com or apachelounge.com have 2.3.16 binaries available for Windows. The problem is with the directive; AcceptFilter httpd none That is the only non-stardard config option. Greg; Thanks for the overview - if I understand

Re: Time for 2.4.0 GA??

2012-01-12 Thread Gregg L. Smith
On 1/12/2012 5:29 PM, Daniel Ruggeri wrote: On 1/12/2012 5:50 PM, Gregg L. Smith wrote: Either apachehaus.com or apachelounge.com have 2.3.16 binaries available for Windows. The problem is with the directive; AcceptFilter httpd none That is the only non-stardard config option. Greg;