<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="58">
<package pkgid="b486bd3a6f23c44bb76659b4386369ed2ddd501b783fd6ad0b59247a7c60b630" name="apache-rpm-macros" arch="src">
  <version epoch="0" ver="20201124" rel="150600.40.6"/>
  <changelog author="pgajdos@suse.com" date="1436788800">- new macro: %{apache_suse_maintenance_mmn} [bnc#915666] (internal)</changelog>
  <changelog author="pgajdos@suse.com" date="1437134400">- %{apache_suse_maintenance_mmn} expands to just 'apache2' when
  apache2 does not provide suse_maintenance_mmn_# symbol</changelog>
  <changelog author="pgajdos@suse.com" date="1437998400">- bump version to 20150717</changelog>
  <changelog author="pgajdos@suse.com" date="1438084800">- this is arch package</changelog>
  <changelog author="pgajdos@suse.com" date="1440763200">- added macros to test loading modules
  %apache_test_module_start_apache
  %apache_test_module_stop_apache
  %apache_test_module_load
  + macros.apache-module-test</changelog>
  <changelog author="pgajdos@suse.com" date="1441022400">- bump version to 20150902</changelog>
  <changelog author="pgajdos@suse.com" date="1441281600">- version 20150903
- %apache_test_module_start_apache:
  * better check that httpd is really running
  * add -p to mkdir test to not fail if test exist and do not
    remove test dir</changelog>
  <changelog author="pgajdos@suse.com" date="1441454400">- version 20150904
- new macros: %apache_test_module_curl, %apache_test_module_dir</changelog>
  <changelog author="pgajdos@suse.com" date="1442318400">- version 20150915
- new macro: %apache_access_syntax_version</changelog>
  <changelog author="pgajdos@suse.com" date="1442577600">- version 20150918
- -m is no longer required (see apache2-mod_apreq2 for usecase)</changelog>
  <changelog author="pgajdos@suse.com" date="1442923200">- version 20150921
- make package usable also for other rpm based distros
- %apache_test_module_start_apache: introduce -p, -u and -g options
- %apache_test_module_curl: introduce -p and -u option</changelog>
  <changelog author="pgajdos@suse.com" date="1443614400">- version 20150930
- %apache_test_module_start_apache, %apache_test_module_load:
  introduce -t option
- %apache_test_module_curl: introduce -r option</changelog>
  <changelog author="pgajdos@suse.com" date="1446724800">- do not append macros.apache-module-test to macros.apache, provide
  separate macros file instead</changelog>
  <changelog author="pgajdos@suse.com" date="1447156800">- require apache-rpm-macros-control [bsc#893659]</changelog>
  <changelog author="pgajdos@suse.com" date="1448539200">- version 20151211
- %apache_test_module_start_apache:
  * declare -p switch in function header
  * fix wording of messages when apache start failed
  * report unsuccessful start also to stderr to see it in build
    log, when stdout is redirected to a file (see apache-test:
    when apache test failed, macro is exiting 1, so the log is
    not cat'ed to output)
  * %{apache_branch} converted to a number: 204 for 2.4,
    202 for 2.2</changelog>
  <changelog author="pgajdos@suse.com" date="1452513600">- version 20160111
  * added %{apache_version}</changelog>
  <changelog author="pgajdos@suse.com" date="1453291200">- version 20161120
- %apache_test_module_start_apache: detect if module is built in
  statically before attempt to search for it in filesystem</changelog>
  <changelog author="ngompa13@gmail.com" date="1574596800">- Replace incorrect usage of %_libexecdir/rpm with %_rpmconfigdir</changelog>
  <changelog author="pgajdos@suse.com" date="1581422400">- version update to 20200211
  * remove %apache_test_* macros, %apache_rex_* is the replacement
    (package apache-rex)
- deleted sources
  - macros.apache-module-test (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1606392000">- version update to 20201124
  * change location of apache2_MMN</changelog>
</package>
<package pkgid="47c7591716397fc6e4baef54455bc58566362014064067b8e7c1d6e5b42ac4c0" name="apache-rpm-macros" arch="x86_64">
  <version epoch="0" ver="20201124" rel="150600.40.6"/>
  <changelog author="pgajdos@suse.com" date="1436788800">- new macro: %{apache_suse_maintenance_mmn} [bnc#915666] (internal)</changelog>
  <changelog author="pgajdos@suse.com" date="1437134400">- %{apache_suse_maintenance_mmn} expands to just 'apache2' when
  apache2 does not provide suse_maintenance_mmn_# symbol</changelog>
  <changelog author="pgajdos@suse.com" date="1437998400">- bump version to 20150717</changelog>
  <changelog author="pgajdos@suse.com" date="1438084800">- this is arch package</changelog>
  <changelog author="pgajdos@suse.com" date="1440763200">- added macros to test loading modules
  %apache_test_module_start_apache
  %apache_test_module_stop_apache
  %apache_test_module_load
  + macros.apache-module-test</changelog>
  <changelog author="pgajdos@suse.com" date="1441022400">- bump version to 20150902</changelog>
  <changelog author="pgajdos@suse.com" date="1441281600">- version 20150903
- %apache_test_module_start_apache:
  * better check that httpd is really running
  * add -p to mkdir test to not fail if test exist and do not
    remove test dir</changelog>
  <changelog author="pgajdos@suse.com" date="1441454400">- version 20150904
- new macros: %apache_test_module_curl, %apache_test_module_dir</changelog>
  <changelog author="pgajdos@suse.com" date="1442318400">- version 20150915
- new macro: %apache_access_syntax_version</changelog>
  <changelog author="pgajdos@suse.com" date="1442577600">- version 20150918
- -m is no longer required (see apache2-mod_apreq2 for usecase)</changelog>
  <changelog author="pgajdos@suse.com" date="1442923200">- version 20150921
- make package usable also for other rpm based distros
- %apache_test_module_start_apache: introduce -p, -u and -g options
- %apache_test_module_curl: introduce -p and -u option</changelog>
  <changelog author="pgajdos@suse.com" date="1443614400">- version 20150930
- %apache_test_module_start_apache, %apache_test_module_load:
  introduce -t option
- %apache_test_module_curl: introduce -r option</changelog>
  <changelog author="pgajdos@suse.com" date="1446724800">- do not append macros.apache-module-test to macros.apache, provide
  separate macros file instead</changelog>
  <changelog author="pgajdos@suse.com" date="1447156800">- require apache-rpm-macros-control [bsc#893659]</changelog>
  <changelog author="pgajdos@suse.com" date="1448539200">- version 20151211
- %apache_test_module_start_apache:
  * declare -p switch in function header
  * fix wording of messages when apache start failed
  * report unsuccessful start also to stderr to see it in build
    log, when stdout is redirected to a file (see apache-test:
    when apache test failed, macro is exiting 1, so the log is
    not cat'ed to output)
  * %{apache_branch} converted to a number: 204 for 2.4,
    202 for 2.2</changelog>
  <changelog author="pgajdos@suse.com" date="1452513600">- version 20160111
  * added %{apache_version}</changelog>
  <changelog author="pgajdos@suse.com" date="1453291200">- version 20161120
- %apache_test_module_start_apache: detect if module is built in
  statically before attempt to search for it in filesystem</changelog>
  <changelog author="ngompa13@gmail.com" date="1574596800">- Replace incorrect usage of %_libexecdir/rpm with %_rpmconfigdir</changelog>
  <changelog author="pgajdos@suse.com" date="1581422400">- version update to 20200211
  * remove %apache_test_* macros, %apache_rex_* is the replacement
    (package apache-rex)
- deleted sources
  - macros.apache-module-test (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1606392000">- version update to 20201124
  * change location of apache2_MMN</changelog>
</package>
<package pkgid="cd9f42b19680c273e52911fee8a03aeb6b5057424d2fce3301d94716c10df03b" name="apache-rpm-macros-control" arch="src">
  <version epoch="0" ver="20151110" rel="150600.11.1"/>
  <changelog author="pgajdos@suse.com" date="1447156800">- initial version of the package 20151110 [bsc#893659]
  macros: %define apache_restart_flag
    %apache_request_restart
    %apache_restart_if_needed</changelog>
  <changelog author="opensuse@cboltz.de" date="1450440000">- fix typo in %apache_request_restart</changelog>
  <changelog author="ngompa13@gmail.com" date="1574596800">- Replace incorrect usage of %_libexecdir/rpm with %_rpmconfigdir</changelog>
</package>
<package pkgid="c57346ac94285255090385546458da0b34cc8451e90c378b3c71f51b66d09329" name="apache-rpm-macros-control" arch="x86_64">
  <version epoch="0" ver="20151110" rel="150600.11.1"/>
  <changelog author="pgajdos@suse.com" date="1447156800">- initial version of the package 20151110 [bsc#893659]
  macros: %define apache_restart_flag
    %apache_request_restart
    %apache_restart_if_needed</changelog>
  <changelog author="opensuse@cboltz.de" date="1450440000">- fix typo in %apache_request_restart</changelog>
  <changelog author="ngompa13@gmail.com" date="1574596800">- Replace incorrect usage of %_libexecdir/rpm with %_rpmconfigdir</changelog>
</package>
<package pkgid="6d246f858ad63b24c71a2cdeaeeb4567fa87d726fb33313b42d9e1d9b52c3cf4" name="apache2" arch="src">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="4f04fed501ae11f276fc592612058f94fcc1e5d5bb2e209b0b00532338195956" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="d22172bc1bba6f3a2cbd95337cf4ce2a03e1e7a2279d419f15cd9a52dd6c9a2b" name="apache2-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="3b09dcb37f32f40d3cd879aef5c57132a4905f48b41e77e6795f05fff183cdd1" name="apache2-debugsource" arch="x86_64">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="959e2b65af502fe0d8e58b723968093fc213b955023f4a199aee68f4f26fcd9c" name="apache2-devel" arch="src">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="fe57e7ebd762f556c84a194748f7f459d038ee98b4a36b44ede695e8a9512f85" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="6856b1b1287ea58533f41e3666954ff9e1cca1fa921737c1e70aecdcf5121a0a" name="apache2-event" arch="src">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="efcc796d2482d844f149b9b1767815c5d0052bd5136e2d97168a25019e198226" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="86d3a1647b22aa2370d3483a7e381e17485af21f39b07f64b7657b68e06fdf35" name="apache2-event-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="a932a23eae80765d24520bb589599aa671139d7197ef9071b3af624e5ee1533b" name="apache2-event-debugsource" arch="x86_64">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="dd686631cb08f26a175cc333b33419669ee7707f3b5f2fdbf4fc15bfb0996829" name="apache2-icons-oxygen" arch="noarch">
  <version epoch="0" ver="1.0.1" rel="150600.33.1"/>
  <changelog author="javier@opensuse.org" date="1265630400">- Initial package</changelog>
  <changelog author="javier@opensuse.org" date="1272283200">- Added missing license</changelog>
  <changelog author="javier@opensuse.org" date="1295784000">- Updated icons from KDE 4.6.0</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile</changelog>
  <changelog author="javier@opensuse.org" date="1429876800">- Update to 1.0.1
  * Apache 2.4 configuration adjustment as pointed out by Fisiu
  * Fix suse-wrong-suse-capitalisation</changelog>
  <changelog author="pgajdos@suse.com" date="1606824000">- use system apache rpm macros</changelog>
</package>
<package pkgid="667178ca1485bac0a719b3f83924654968e2d5a01c566b56ea57636d1d7b51e1" name="apache2-icons-oxygen" arch="src">
  <version epoch="0" ver="1.0.1" rel="150600.33.1"/>
  <changelog author="javier@opensuse.org" date="1265630400">- Initial package</changelog>
  <changelog author="javier@opensuse.org" date="1272283200">- Added missing license</changelog>
  <changelog author="javier@opensuse.org" date="1295784000">- Updated icons from KDE 4.6.0</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile</changelog>
  <changelog author="javier@opensuse.org" date="1429876800">- Update to 1.0.1
  * Apache 2.4 configuration adjustment as pointed out by Fisiu
  * Fix suse-wrong-suse-capitalisation</changelog>
  <changelog author="pgajdos@suse.com" date="1606824000">- use system apache rpm macros</changelog>
</package>
<package pkgid="343b109e8e8047000d63eecd6d573baec78f7f0ce54e838973c5e2fd4fb55dd3" name="apache2-manual" arch="noarch">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="b343025ecc692c3347d197060a5bc4cf283b0e22ad49ec5fa7812b9ac0a401c7" name="apache2-manual" arch="src">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="da0e3646606e005ee0f3f4dbdb53adcbfe89acfccff0fe2f66a84d2c976836cd" name="apache2-prefork" arch="src">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="1d40781aba418e5780de754701d23b1dcba878ab8df3010f01be98be7fbc759f" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="0c4f6a492a26fed3cb13c4c6679fe8ae6007204cbc64c99436756440afd3be7c" name="apache2-prefork-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="a7cebfbfd41dbdd5a83d86b081c4499b0fe269c4697d81735eecd438e6eb5980" name="apache2-prefork-debugsource" arch="x86_64">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="c40dc800a6f6ee3b5ca9ea657b97cca5e90195c682a09b36ee3567e994f00490" name="apache2-test_devel" arch="src">
  <version epoch="0" ver="2.4.67" rel="150600.345.2"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="84282769f26ccb1d3e565c54e07f42d7a46c88b4cbf12a39ee2dcac3420d063f" name="apache2-test_event" arch="src">
  <version epoch="0" ver="2.4.67" rel="150600.345.2"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="16adbe55884ff75c9fecbd3a57e864fe28f3e4a64938ac70759e9869a858d18a" name="apache2-test_main" arch="src">
  <version epoch="0" ver="2.4.67" rel="150600.345.2"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="4adb4d5c86409c6c688af382461244ab74acb65fb9ce7793a89c9aa2ecddb6b9" name="apache2-test_prefork" arch="src">
  <version epoch="0" ver="2.4.67" rel="150600.345.2"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="aac8f95c81ba94863a42708bfd7f8fd45bada7a0c303b0fe8c3cc506446a505b" name="apache2-test_worker" arch="src">
  <version epoch="0" ver="2.4.67" rel="150600.345.2"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="7814fcb1e5dc292cead1886abb6452cf5722e79ded004861883809428f0a1aff" name="apache2-utils" arch="src">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="161d98f1ade648c224db26266a18af93cd08aa34aa87b8c2cf432ef6510daccd" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="ac7a05580834d73bcf1a76fca8ecbcd1aee161ddd27b7583db8dc85437f441b2" name="apache2-utils-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="b9bc8f2e5ed041f42148a8c018ebaaf05baa91af6606f28f2715cf85b917082e" name="apache2-utils-debugsource" arch="x86_64">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="fb6bb7f98526bbb5bcab9b4077e8c9bf83fddaf6d1dd10756e40de11f5ee6ee1" name="apache2-worker" arch="src">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="23a5ed617cadab6131284eb37aba8ce0b822ab8377f4a8352f82de127ccada89" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="faeac0f289218048cdb8029448b94366944456b8d5875c4c9fe3fae82c3937d0" name="apache2-worker-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="e4c7a61b042c45bac64629e21e58f6d69dcc557117bd43121310b3406af0dde5" name="apache2-worker-debugsource" arch="x86_64">
  <version epoch="0" ver="2.4.67" rel="150600.345.1"/>
  <changelog author="suse+build@de-korte.org" date="1720094400">- Update to 2.4.61
  * ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1227353]
    A regression in the core of Apache HTTP Server 2.4.60 ignores
    some use of the legacy content-type based configuration of
    handlers.   "AddType" and similar configuration, under some
    circumstances where files are requested indirectly, result in
    source code disclosure of local content. For example, PHP
    scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.61, which fixes
    this issue.
- Update to 2.4.60
  * ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy
    handler substitution (cve.mitre.org) [boo#1227271]
    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and
    earlier allows an attacker to cause unsafe RewriteRules to
    unexpectedly setup URL's to be handled by mod_proxy.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in
    Denial of Service in mod_proxy via a malicious request
    (cve.mitre.org) [boo#1227270]
    null pointer dereference in mod_proxy in Apache HTTP Server
    2.4.59 and earlier allows an attacker to crash the server via a
    malicious request.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38476: Apache HTTP Server may use
    exploitable/malicious backend application output to run local
    handlers via internal redirect (cve.mitre.org) [boo#1227269]
    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier
    are vulnerably to information disclosure, SSRF or local script
    execution via backend applications whose response headers are
    malicious or exploitable.
    Note: Some legacy uses of the 'AddType' directive to connect a
    request to a handler must be ported to 'AddHandler' after this fix.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in
    mod_rewrite when first segment of substitution matches
    filesystem path. (cve.mitre.org) [boo#1227268]
    Improper escaping of output in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows an attacker to map URLs to filesystem
    locations that are permitted to be served by the server but are
    not intentionally/directly reachable by any URL, resulting in
    code execution or source code disclosure.
    Substitutions in server context that use a backreferences or
    variables as the first segment of the substitution are affected.
    Some unsafe RewiteRules will be broken by this change and the
    rewrite flag "UnsafePrefixStat" can be used to opt back in once
    ensuring the substitution is appropriately constrained.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with
    encoded question marks in backreferences (cve.mitre.org)
    [boo#1227278]
    Substitution encoding issue in mod_rewrite in Apache HTTP Server
    2.4.59 and earlier allows attacker to execute scripts in
    directories permitted by the configuration but not directly
    reachable by any URL or source disclosure of scripts meant to
    only to be executed as CGI.
    Note: Some RewriteRules that capture and substitute unsafely will now
    fail unless rewrite flag "UnsafeAllow3F" is specified.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding
    problem (cve.mitre.org) [boo#1227276]
    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and
    earlier allows request URLs with incorrect encoding to be sent
    to backend services, potentially bypassing authentication via
    crafted requests.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF
    (cve.mitre.org) [boo#1227267]
    SSRF in Apache HTTP Server on Windows allows to potentially leak
    NTML hashes to a malicious server via SSRF and malicious
    requests or content
    Note: Existing configurations that access UNC paths
    will have to configure new directive "UNCList" to allow access
    during request processing.
    Credits: Orange Tsai (@orange_8361) from DEVCORE
  * ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null
    pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272]
    Serving WebSocket protocol upgrades over a HTTP/2 connection
    could result in a Null Pointer dereference, leading to a crash
    of the server process, degrading performance.
    Credits: Marc Stern (&lt;marc.stern AT approach-cyber.com&gt;)
  * ) mod_proxy: Fix DNS requests and connections closed before the
    configured addressTTL.  BZ 69126.  [Yann Ylavic]
  * ) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
  * ) core: Support zone/scope in IPv6 link-local addresses in Listen and
    VirtualHost directives (requires APR 1.7.x or later).  PR 59396
    [Joe Orton]
  * ) mod_ssl: Reject client-initiated renegotiation with a TLS alert
    (rather than connection closure).  [Joe Orton, Yann Ylavic]
  * ) Updated mime.types.  [Mohamed Akram &lt;mohd.akram outlook.com&gt;,
    Adam Silverstein &lt;adamsilverstein earthboundhosting.com&gt;]
  * ) mod_ssl: Fix a regression that causes the default DH parameters for a key
    no longer set and thus effectively disabling DH ciphers when no explicit
    DH parameters are set. PR 68863 [Ruediger Pluem]
  * ) mod_cgid: Optional support for file descriptor passing, fixing
    error log handling (configure --enable-cgid-fdpassing) on Unix
    platforms. PR 54221.  [Joe Orton]
  * ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in
    error logs.  PR 61980.  [Hank Ibell &lt;hwibell gmail.com&gt;]
  * ) mod_tls: update version of rustls-ffi to v0.13.0.
    [Daniel McCarney (@cpu}]
  * ) mod_md:
  - Using OCSP stapling information to trigger certificate renewals. Proposed
    by @frasertweedale.
  - Added directive `MDCheckInterval` to control how often the server checks
    for detected revocations. Added proposals for configurations in the
    README.md chapter "Revocations".
  - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is
    allowed in RFC 6960. Treat those as having an update interval of 12 hours.
    Added by @frasertweedale.
  - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.
- removed patches (upstreamed)
  - apache2-issue-444.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1722686400">- Update to 2.4.62
  * ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
    mod_rewrite in server/vhost context on Windows (cve.mitre.org)
    [boo#1228098]
    SSRF in Apache HTTP Server on Windows with mod_rewrite in
    server/vhost context, allows to potentially leak NTML hashes to
    a malicious server via SSRF and malicious requests.
    Users are recommended to upgrade to version 2.4.62 which fixes
    this issue.
    Credits: Smi1e (DBAPPSecurity Ltd.)
  * ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
    disclosure with handlers configured via AddType (cve.mitre.org)
    [boo#1228097]
    A partial fix for  CVE-2024-39884 in the core of Apache HTTP
    Server 2.4.61 ignores some use of the legacy content-type based
    configuration of handlers. "AddType" and similar configuration,
    under some circumstances where files are requested indirectly,
    result in source code disclosure of local content. For example,
    PHP scripts may be served instead of interpreted.
    Users are recommended to upgrade to version 2.4.62, which fixes
    this issue.
  * ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
    "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
    with BalancerMember(s).  PR 69168.  [Yann Ylavic]
  * ) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
    PR 69160 [Yann Ylavic]
  * ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
    [Joe Orton]
  * ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
    via OpenSSL 3.x providers.  [Ingo Franzki &lt;ifranzki linux.ibm.com&gt;]
  * ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL &gt;= 3.0.
    [Ruediger Pluem, Yann Ylavic]
  * ) mpm_worker: Fix possible warning (AH00045) about children processes not
    terminating timely.  [Yann Ylavic]</changelog>
  <changelog author="kukuk@suse.com" date="1727697600">- Add /srv/www directories to filelist [bsc#1231027]
  (apache2 will not start since default config uses this directory)</changelog>
  <changelog author="jengelh@inai.de" date="1730721600">- Explicitly mark start_apache2 as bash-dependent.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1730808000">- Update httpd-framework to svn1921782.
- Fixes Apache's impact on bsc#1218342.</changelog>
  <changelog author="dimstar@opensuse.org" date="1736856000">- Fix builds of test package with RPM 4.20:
  + noarch packages cannot rely on libdir, which is an
    arch-dependent variable. Rely on apxs -q libdir to extract the
    correct information instead.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1741608000">- Update to 2.4.63:
  * mod_dav: Update redirect-carefully example BrowserMatch config
    to match more recent client versions.
  * mod_cache_socache: Fix possible crash on error path.
  * mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
  * mod_md: update to version 2.4.31
  - Improved error reporting when waiting for ACME server to verify
    domains or finalizing the order fails, e.g. times out.
  - Increasing the timeouts to wait for ACME server to verify domain
    names and issue the certificate from 30 seconds to 5 minutes.
  - Change a log level from error to debug when Stapling is enabled
    but a certificate carries no OCSP responder URL.
  * mod_proxy_balancer: Fix the handling of the stickysession
    configuration parameter by the balancer manager.
  * Add the ldap-search option to mod_authnz_ldap, allowing
    authorization to be based on arbitrary expressions that do not
    include the username.  Make sure that when ldap searches are too
    long, we explicitly log the error.
  * mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
    in the host name or port.
  * mod_log_config: Fix merging for the "LogFormat" directive.
  * mod_lua: Make r.ap_auth_type writable.
  * mod_md: update to version 2.4.29
  - Fixed HTTP-01 challenges to not carry a final newline, as some
    ACME server fail to ignore it.
  - Fixed missing label+newline in server-status plain text output
    when MDStapling is enabled.
  * mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
    without "SSLCryptoDevice" configured.
  * mod_authnz_ldap: Fix possible memory corruption if the
    AuthLDAPSubGroupAttribute directive is configured.
  * mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
  * mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs,
    including "unix:" ones.
  * mod_rewrite: Error out in case a RewriteRule in directory context
    uses the proxy, but mod_proxy is not loaded.
  * http: Remove support for Request-Range header sent by Navigator
    2-3 and MSIE 3.
  * mod_rewrite: Don't require flag to preserve a leading // added by
    applying the perdir prefix to the substitution.
  * Windows: Restore the ability to "Include" configuration files on
    UNC paths.
  * mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
    in Location (incomplete fix in 2.4.62).
  * mod_md: update to version 2.4.28
  - When the server starts, it looks for new, staged certificates to
    activate. If the staged set of files in 'md/staging/' is messed
    up, this could prevent further renewals to happen. Now, when the
    staging set is present, but could not be activated due to an
    error, purge the whole directory.
  - Fix certificate retrieval on ACME renewal to not require a
    'Location:' header returned by the ACME CA. This was the way it
    was done in ACME before it became an IETF standard. Let's
    Encrypt still supports this, but other CAs do not.
  - Restore compatibility with OpenSSL &lt; 1.1.
  * mod_tls: removed the experimental module. It now is availble
    standalone from https://github.com/icing/mod_tls. The rustls
    provided API is not stable and does not align with the httpd
    release cycle.
  * mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
  * mod_http2: Return connection monitoring to the event MPM when
    blocking on client updates.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1752840000">* Refresh patches:
  - apache-test-application-xml-type.patch
  - apache-test-turn-off-variables-in-ssl-var-lookup.patch
  - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
  - apache2-LimitRequestFieldSize-limits-headers.patch
  * Update to 2.4.64.
  * CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
  * CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
  * CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
  * CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
  * CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
  * CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
  * CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
  * CVE-2024-42516: Apache HTTP Server: HTTP response splitting
  * mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
  size.
  * mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
  builds which enable it in libssl natively.
  * mod_asis: Fix the log level of the message AH01236.
  * mod_session_dbd: ensure format used with SessionDBDCookieName and
  SessionDBDCookieName2 are correct.
  * mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
  inadvertently modify the Content-Type _response_ header. Applies to
  Content-Type only and likely to only affect static file responses.
  * mod_ssl: Remove warning over potential uninitialised value
  for ssl protocol prior to protocol selection.
  * mod_proxy: Reuse ProxyRemote connections when possible, like prior
  to 2.4.59.
  * mod_systemd: Add systemd socket activation support.
  * mod_systemd: Log the SELinux context at startup if available and
  enabled.
  * mod_http2: update to version 2.0.32
  The code setting the connection window size was set wrong,
  preventing `H2WindowSize` to work.
  * mod_http2: update to version 2.0.30
- Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
- Added new directive `H2MaxHeaderBlockLen` to set the limit on response
  header sizes.
- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.
  * mod_lua: Fix memory handling in LuaOutputFilter.
  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  * mod_proxy_balancer: Fix a regression that caused stickysession keys no
  longer be recognized if they are provided as query parameter in the URL.
  * mod_md: update to version 2.5.2
- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
  with EC keys before RSA ones.
- Fixed missing newlines in the status page output.
  * mod_dav: Add API to expose DavBasePath setting.
  * mod_md: update to version 2.5.1
  - Added support for ACME profiles with new directives MDProfile and
    MDProfileMandatory.
  - When installing a custom CA file via `MDCACertificateFile`, also set the
    libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
    (when curl is linked with it) about missing CRL/OCSP in certificates.
  - Fixed handling of corrupted httpd.json and added test 300_30 for it.
    File is removed on error and written again. Fixes #369.
  - Added explanation in log for how to proceed when md_store.json could not be
    parsed and prevented the server start.
  - restored fixed to #336 and #337 which got lost in a sync with Apache svn
  - Add Issue Name/Uris to certificate information in md-status handler
  - MDomains with static certificate files have MDRenewMode "manual", unless
    "always" is configured.
  * core: Report invalid Options= argument when parsing AllowOverride
  directives.
  * scoreboard/mod_http2: record durations of HTTP/2 requests.</changelog>
  <changelog author="pgajdos@suse.com" date="1753272000">- version update to 2.4.65
  * ) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
    always evaluates to true in 2.4.64 (cve.mitre.org)
    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
    expr ..." tests evaluating as "true".
    Users are recommended to upgrade to version 2.4.65, which fixes
    the issue.</changelog>
  <changelog author="pgajdos@suse.com" date="1758628800">- httpd testsuite of svn revision 1928711, fixes the failure
  caused by libxml2 version update to 2.14</changelog>
  <changelog author="martin.schreiner@suse.com" date="1760356800">- Migrate from update-alternatives (bsc#1245830).
- The APACHE_MPM environment variable now controls which MPM will be used.
  If an empty string is provided, the script-helpers file implements its own logic
  to pick an MPM from the currently installed ones.
  As at least one MPM is always required, this will work just fine.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Re-introduce /usr/sbin/httpd
- Links to start_apache2, which now contains the logic to dispatch
  to the appropriate MPM respecting sysconfig's decision.</changelog>
  <changelog author="dimstar@opensuse.org" date="1761912000">- Ensure the mpm subpackages sync their rebuild counter with the
  main package to have the installations work reliably.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1762257600">- Make /usr/sbin/httpd a dedicated script again, this fixes building modules
  while still making Apache free of update-alternatives, relying entirely
  on sysconfig to dispatch the appropriate MPM.</changelog>
  <changelog author="suse+build@de-korte.org" date="1764849600">- version update to 2.4.66
  * ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
    bypass via AllowOverride FileInfo (cve.mitre.org)
    mod_userdir+suexec bypass via AllowOverride FileInfo
    vulnerability in Apache HTTP Server. Users with access to use
    the RequestHeader directive in htaccess can cause some CGI
    scripts to run under an unexpected userid.
    This issue affects Apache HTTP Server: from 2.4.7 through
    2.4.65.
  * ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
    variable override (cve.mitre.org)
    Improper Neutralization of Escape, Meta, or Control Sequences
    vulnerability in Apache HTTP Server through environment
    variables set via the Apache configuration unexpectedly
    superseding variables calculated by the server for CGI programs.
    This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
  * ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
    Windows through UNC SSRF (cve.mitre.org)
    Server-Side Request Forgery (SSRF) vulnerability
    Â in Apache HTTP Server on Windows
    with AllowEncodedSlashes OnÂ and MergeSlashes OffÂ  allows to
    potentially leak NTLM
    hashes to a malicious server via SSRF and malicious requests or
    content
  * ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
    Includes adds query string to #exec cmd=... (cve.mitre.org)
    Apache HTTP Server 2.4.65 and earlier with Server Side Includes
    (SSI) enabled and mod_cgid (but not mod_cgi) passes the
    shell-escaped query string to #exec cmd="..." directives.
    This issue affects Apache HTTP Server before 2.4.66.
  * ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
    unintended retry intervals (cve.mitre.org)
    An integer overflow in the case of failed ACME certificate
    renewal leads, after a number of failures (~30 days in default
    configurations), to the backoff timer becoming 0. Attempts to
    renew the certificate then are repeated without delays until it
    succeeds.
    This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
  * ) mod_http2: Fix handling of 304 responses from mod_cache.
  * ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
    integers, used in push diaries and proxy window size calculations.
  * ) mod_md: update to version 2.6.5
  - New directive `MDInitialDelay`, controlling how longer to wait after
    a server restart before checking certificates for renewal.
    [Michael Kaufmann]
  - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
    versions, the parsing of ASN.1 time strings did not do a length check.
  - Hardening: when reading back OCSP responses stored in the local JSON
    store, missing 'valid' key led to uninitialized values, resulting in
    wrong refresh behaviour.
  * ) mod_md: update to version 2.6.6
  - Fix a small memory leak when using OpenSSL's BIGNUMs.
  - Fix reuse of curl easy handles by resetting them.
  * ) mod_http2: update to version 2.0.35
    New directive `H2MaxStreamErrors` to control how much bad behaviour
    by clients is tolerated before the connection is closed.
  * ) mod_proxy_http2: add support for ProxyErrorOverride directive.
  * ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
    the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
  * ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
    host compatibility policy.
  * ) mod_md: update to version 2.6.2
  - Fix error retry delay calculation to not already doubling the wait
    on the first error.
  * ) mod_md: update to version 2.6.1
  - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
    traffic on errored renewals for the ACME CA. This leads to error retries
    of 30s, 1 minute, 2, 4, etc. up to daily attempts.
  - Checking that configuring `MDRetryDelay` will result in a positive
    duration. A delay of 0 is not accepted.
  - Fix a bug in checking Content-Type of responses from the ACME server.
  - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
    directive "MDRenewViaARI on|off" for controlling this.
  - Removing tailscale support. It has not been working for a long time
    as the company decided to change their APIs. Away with the dead code,
    documentation and tests.
  - Fixed a compilation issue with pre-industrial versions of libcurl.
- httpd testsuite of svn revision 1929573</changelog>
  <changelog author="martin.schreiner@suse.com" date="1767528000">- Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking
  /usr/sbin/httpd.
  The appropriate MPM was not being located when calling /usr/sbin/httpd
  directly.
- Rename event's 'mod_cgi' to 'mod_cgid' in loadmodule.conf, as that's what
  the event MPM ships.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777377600">- Fix bsc#1262159.
- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25).
  Decreased to 250.
- use tmpfiles.d for runtime directory creation
  This improves compatibility with immutable OSs, such as MicroOS.
- Add apache2.tmpfiles.
- Drop buildroot mkdir calls for log, cache and lib directories:
  these are now created at runtime via tmpfiles.d
- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost
  in %files: RPM registers ownership without packaging the paths</changelog>
  <changelog author="martin.schreiner@suse.com" date="1777636800">- cgi-bin is disabled by default in modern Apache configurations;
  creating it unconditionally via tmpfiles.d is unnecessary
- Remove /srv/www/cgi-bin from apache2.tmpfiles
- Drop %ghost %dir %{cgidir} from %files
- Drop %{cgidir} from %check mkdir invocation</changelog>
  <changelog author="suse+build@de-korte.org" date="1778068800">- version update to 2.4.67
  * ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
    Heap Over-Read and memory disclosure in  ajp_parse_data()
    [boo#1263950]
    Buffer Over-read vulnerability in Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
    Heap Buffer Over-Read Due to Missing Null-Termination Check
    (ajp_msg_get_string) [boo#1263951]
    Improper Null Termination, Out-of-bounds Read vulnerability in
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
    reads in AJP getter functions [boo#1263952]
    Out-of-bounds Read vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
    HTTP response splitting forwarding malicious status line
    [boo#1263953]
    HTTP response splitting vulnerability in multiple Apache HTTP
    Server modules with untrusted or compromised backend servers.
    This issue affects Apache HTTP Server: from through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
    crash [boo#1263954]
    A NULL pointer dereference in the mod_authn_socache in Apache
    HTTP Server 2.4.66 and earlier allows an unauthenticated remote
    user to crash a child process in a caching forward proxy
    configuration.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
    timing attack [boo#1263955]
    A timing attack against mod_auth_digest in Apache HTTP Server
    2.4.66 allows a bypass of Digest authentication by a remote
    attacker.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
    indirect lock crash [boo#1263956]
    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
    2.4.66 and earlier may allow an attacker to crash the server
    with a malicious request.mod_dav_lock is not used internally by
    mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from
    Apache Subversion earlier than version 1.2.0.
    Users are recommended to upgrade to version 2.4.66, which fixes
    this issue, or remove mod_dav_lock.
  * ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
    unrestricted OCSP response [boo#1264150]
    Allocation of Resources Without Limits or Throttling
    vulnerability in Apache HTTP Server'sÂ  mod_md via OCSP response
    data.
    This issue affects Apache HTTP Server: from 2.4.30 through
    2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
    mod_proxy_ajp via  ajp_msg_check_header() [boo#1264163]
    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
    Apache HTTP Server.
    If mod_proxy_ajp connects to a malicious AJP server this AJP
    server can send a malicious AJP message back to mod_proxy_ajp
    and cause it to write 4 attacker controlled bytes after the end
    of a heap based buffer.
    This issue affects Apache HTTP Server: through 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
    elevation of privileges via ap_expr [boo#1263935]
    An escalation of privilege bug in various modules in Apache HTTP
    2.4.66 and earlier allows local .htaccess authors to read files
    with the privileges of the httpd user.
    Users are recommended to upgrade to version 2.4.67, which fixes
    this issue.
  * ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
    and possible RCE on early reset [boo#1263957]
    Double Free and possible RCE vulnerability in Apache HTTP Server
    with the HTTP/2 protocol.
    This issue affects Apache HTTP Server: 2.4.66.
    Users are recommended to upgrade to version 2.4.67, which fixes
    the issue.
  * ) mod_md: update to version 2.6.10
  - Fix issue #420 &lt;https://github.com/icing/mod_md/issues/420&gt; by ignoring
    job.json files that claim to have completely finished a certificate
    renewal, but have not produced the necessary result files.
  * ) mod_http2: update to version 2.0.39
    Remove streams own memory allocator after reports of memory problems
    with third party modules.
  * ) mod_http2: update to version 2.0.38
    Source sync with mod_h2 github repository. No functional change.
  * ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
  * ) mod_md: update to version 2.6.7
  - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
    applied, no matter the configuration.
  * ) mod_md: update to version 2.6.9
  - Pebble 2.9+ reports another error when terms of service agreement is
    not set. Treating all "userActionRequired" errors as permanent now.
  * ) mod_md: update to version 2.6.8
  - Fix the ARI related `replaces` property in ACME order creation to only
    be used when the CA supports ARI and it is enabled in the menu config.
  - Fix compatibility with APR versions before 1.6.0 which do not have
    `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
  * ) mod_http2: update to version 2.0.37
    Prevent double purge of a stream, resulting in a double free.
    Fixes PR 69899.
  * ) mod_md: Use correct function name when compiling against APR &lt; 1.6.0.</changelog>
  <changelog author="martin.schreiner@suse.com" date="1778155200">- Remove last remnants of update-alternatives.</changelog>
</package>
<package pkgid="73520051239cd2d769d707463e77f02f38db387b17554016e35e475336f6ba04" name="apr" arch="src">
  <version epoch="0" ver="1.7.6" rel="150600.59.2"/>
  <changelog author="mpluskal@suse.com" date="1508155200">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Do not require python for building - its not needed anyways
  (fate#323526)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1516708800">- ignore PowerPC transient test failures</changelog>
  <changelog author="mliska@suse.cz" date="1524052800">- Add gcc8-integer-overflow.patch to handle an undefined
  behavior (boo#1090085).</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1525953600">- Version 1.6.3:
  * apr_file_trunc: Truncating a buffered file could add unexpected
  data after the truncate position. PR 51017.
  * apr_file_trunc: Fix an issue where reading from a buffered file
  after truncate could return stale data from the buffer.
  * apr_ipsubnet_create() now fails for an empty input string.
- fixes [bsc#1092981]</changelog>
  <changelog author="mmanu84@outlook.de" date="1539864000">- Version 1.6.5
  * Fix Win32 build breakage in apr_os_exp_time_put() in 1.6.4. [Rainer Jung]
- Version 1.6.4
  * configure: Fix detection of &lt;net/if.h&gt; on OpenBSD.
  PR 61976. [David Carlier &lt;devnexen gmail.com&gt;, Yann Ylavic]
  * Fix apr_parse_addr_port() regression in scope_id parsing introduced
  in 1.6.3.  [Rainer Jung]
  * Fix Win32 file buffer locking behavior for single threaded file streams.
  [Evgeny Kotkov, Mladen Turk, Jean-Frederic Clere]
  * Numerous corrections to APR poll behavior. [Yann Ylavic]
- Drop patch gcc8-integer-overflow.patch merged upstream</changelog>
  <changelog author="tchvatal@suse.com" date="1547640000">- Update keyring to match current release maintainer</changelog>
  <changelog author="pgajdos@suse.com" date="1549540800">- linux version is now checked correctly, drop
  - apr-1.4.5-linux3.patch
    (see change log from Sun Aug  7 01:21:44 UTC 2011)</changelog>
  <changelog author="pgajdos@suse.com" date="1549627200">- increase timeout to fix random failure of testsuite
  + apr-test-sendfile-timeout.patch
- fix build for SLE11 again</changelog>
  <changelog author="mmanu84@outlook.de" date="1564833600">- Version 1.7.0
  * apr_dir_read: [Unix] Dropped the preference of the dirread_r() flavor
    for dirread(), because the former is both deprecated and unneeded.
    [Yann Ylavic, William Rowe]
  * apr_file_info: [Win32 only] Treat only "name surrogate" reparse points
    as symlinks, and not other reparse tag types. PR47630
    [Oleg Liatte &lt;olegliatte gmail.com&gt;]
  * Test %ld vs. %lld to avoid compiler emits using APR_OFF_T_FMT, in the
    case of apparently equivilant long and long long types. [William Rowe]
  * Recognize APPLE predefined macros as equivilant to DARWIN. [Jim Jagielski]
  * Signals: Allow handling of SIGUSR2 in apr_signal_thread. [Yann Ylavic]
  * Atomics: Support for 64bit ints. [Jim Jagielski]
  * Add the apr_encode_* API that implements RFC4648 and RFC7515
    compliant BASE64, BASE64URL, BASE32, BASE32HEX and BASE16
    encode/decode functions. [Graham Leggett]
  * rand: Use arc4random_buf() on BSD platforms and getrandom() on Linux,
    when available. [Christian Weisgerber &lt;naddy openbsd.org, Yann Ylavic]
  * Add apr_sockaddr_zone_set, apr_sockaddr_zone_set to set and retrieve
    the zone for link-local IPv6 addresses.  [Joe Orton]
  * apr_sockaddr_equal: Compare link-local IPv6 addresses with different
    zones as not equal.  [Joe Orton]
  * apr_sockaddr_ip_getbuf, apr_sockaddr_ip_get: Append "%zone" for
    IPv6 link-local addresses.  [Joe Orton]
  * Locks: add a --disable-timedlocks config option in case users
    encounter more platforms where it fails [Nick Kew].
  * apr_allocator, apr_pools: Add apr_allocator_page_size() and
    apr_allocator_min_order_set() to respectively get the (system's) page size
    in use and set the minimum allocation size for an allocator (expressed in
    2^order pages).  [Yann Ylavic]
  * locks: provide portable implementations of timedlock()s for
    posix-sems, sysv-sems and pthreads for those platforms that
    lack native versions (eg: OSX/macOS). [Jim Jagielski]
  * locks: Introduce apr_{thread,proc,global}_mutex_timedlock().
    [Yann Ylavic]
- Remove patch
  * apr-use-getrandom.patch no longer needed, apr 1.7.0 use getrandom() on Linux,
    when available.
- Refresh apr-visibility.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1630584000">- security update
- added patches
  fix CVE-2021-35940 [bsc#1190072], Regression of fix in apr 1.7
  + apr-CVE-2021-35940.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191747]</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- deleted patches
  - apr-CVE-2021-3594.patch (renamed)
- added patches
  + apr-CVE-2021-35940.patch (correct name)</changelog>
  <changelog author="coolo@suse.com" date="1648296000">- Remove autoreconf call, it breaks with uptodate autoconf versions</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.7.2:
  * CVE-2022-24963: Integer Overflow or Wraparound vulnerability in
    apr_encode functions allows an attacker to write beyond bounds
    of a buffer (boo#1207870)
  * Add error handling for lseek() failures in apr_file_write() and
    apr_file_writev()
  * Avoid an overflow on 32 bit platforms
  * Don't silently set APR_FOPEN_NOCLEANUP for apr_file_mktemp()
    created file to avoid a fd and inode leak when/if later passed
    to apr_file_setaside().
  * build system fixes and fixes for other platforms
- drop apr-CVE-2021-35940.patch included upstream (CVE-2021-35940)</changelog>
  <changelog author="dmueller@suse.com" date="1681646400">- update to 1.7.3:
  * apr-1-config: Fix crosscompiling detection
  * configure: Add --enable-sysv-shm to use SysV shared
    memory (shmget) if available.
  * apr_socket_sendfile: Use WSAIoctl() to get TransmitFile
    function pointer on Windows. [Ivan Zhakov]
  * apr_dir_read: Do not request short file names on Windows
    7 and later. [Ivan Zhakov]
  * apr_file_gets: Optimize for buffered files on Windows.
  * Fix a deadlock when writing to locked files opened with
    APR_FOPEN_APPEND on Windows. PR 50058. [Evgeny Kotkov]
  * Don't seek to the end when opening files with
    APR_FOPEN_APPEND on Windows.
  * apr_file_write: Optimize large writes to buffered files
    on Windows.
  * apr_file_write: Optimize large reads from buffered files
    on Windows.</changelog>
  <changelog author="pgajdos@suse.com" date="1681992000">- version update to 1.7.4
  * ) Fix a regression where writing to a file opened with both APR_FOPEN_APPEND
    and APR_FOPEN_BUFFERED did not properly append the data on Windows.
    (This regression was introduced in APR 1.7.3)  [Evgeny Kotkov]</changelog>
  <changelog author="bwiedemann@suse.com" date="1702900800">- Add reproducible.patch to drop build host name (boo#1084909)</changelog>
  <changelog author="pgajdos@suse.com" date="1726574400">- version update to 1.7.5 [bsc#1229783] CVE-2023-49582
  * ) Unix: Implement apr_shm_perms_set() for the "POSIX shm_open()"
    and "classic mmap" shared memory implementations.  [Joe Orton,
    Ruediger Pluem]
  * ) Fix missing ';' for XML/HTML hex entities from apr_escape_entity().
    [Yann Ylavic]
  * ) Fix crash in apr_pool_create() with --enable-pool-debug=all|owner.
    [Yann Ylavic]
  * ) Improve platform detection by updating config.guess and config.sub.
    [Rainer Jung]
  * ) CMake: Add support for CMAKE_WARNING_AS_ERROR. [Ivan Zhakov]
  * ) CMake: Enable support for MSVC runtime library selection by abstraction.
    [Ivan Zhakov]
  * ) CMake: Export installed targets (libapr-1, apr-1, libaprapp-1, aprapp-1)
    to apr:: namespace. [Ivan Zhakov]
- modified patches
  % apr-visibility.patch (refreshed)
  % reproducible.patch (refreshed)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1748088000">- update to 1.7.6:
  * build system fixes
  * fixes to regression tests
  * fixes for other platforms</changelog>
</package>
<package pkgid="3b07084e70d05eb628b80d3a25eeb635c7e11193900fffeead37bce99d797abc" name="apr-debugsource" arch="x86_64">
  <version epoch="0" ver="1.7.6" rel="150600.59.2"/>
  <changelog author="mpluskal@suse.com" date="1508155200">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Do not require python for building - its not needed anyways
  (fate#323526)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1516708800">- ignore PowerPC transient test failures</changelog>
  <changelog author="mliska@suse.cz" date="1524052800">- Add gcc8-integer-overflow.patch to handle an undefined
  behavior (boo#1090085).</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1525953600">- Version 1.6.3:
  * apr_file_trunc: Truncating a buffered file could add unexpected
  data after the truncate position. PR 51017.
  * apr_file_trunc: Fix an issue where reading from a buffered file
  after truncate could return stale data from the buffer.
  * apr_ipsubnet_create() now fails for an empty input string.
- fixes [bsc#1092981]</changelog>
  <changelog author="mmanu84@outlook.de" date="1539864000">- Version 1.6.5
  * Fix Win32 build breakage in apr_os_exp_time_put() in 1.6.4. [Rainer Jung]
- Version 1.6.4
  * configure: Fix detection of &lt;net/if.h&gt; on OpenBSD.
  PR 61976. [David Carlier &lt;devnexen gmail.com&gt;, Yann Ylavic]
  * Fix apr_parse_addr_port() regression in scope_id parsing introduced
  in 1.6.3.  [Rainer Jung]
  * Fix Win32 file buffer locking behavior for single threaded file streams.
  [Evgeny Kotkov, Mladen Turk, Jean-Frederic Clere]
  * Numerous corrections to APR poll behavior. [Yann Ylavic]
- Drop patch gcc8-integer-overflow.patch merged upstream</changelog>
  <changelog author="tchvatal@suse.com" date="1547640000">- Update keyring to match current release maintainer</changelog>
  <changelog author="pgajdos@suse.com" date="1549540800">- linux version is now checked correctly, drop
  - apr-1.4.5-linux3.patch
    (see change log from Sun Aug  7 01:21:44 UTC 2011)</changelog>
  <changelog author="pgajdos@suse.com" date="1549627200">- increase timeout to fix random failure of testsuite
  + apr-test-sendfile-timeout.patch
- fix build for SLE11 again</changelog>
  <changelog author="mmanu84@outlook.de" date="1564833600">- Version 1.7.0
  * apr_dir_read: [Unix] Dropped the preference of the dirread_r() flavor
    for dirread(), because the former is both deprecated and unneeded.
    [Yann Ylavic, William Rowe]
  * apr_file_info: [Win32 only] Treat only "name surrogate" reparse points
    as symlinks, and not other reparse tag types. PR47630
    [Oleg Liatte &lt;olegliatte gmail.com&gt;]
  * Test %ld vs. %lld to avoid compiler emits using APR_OFF_T_FMT, in the
    case of apparently equivilant long and long long types. [William Rowe]
  * Recognize APPLE predefined macros as equivilant to DARWIN. [Jim Jagielski]
  * Signals: Allow handling of SIGUSR2 in apr_signal_thread. [Yann Ylavic]
  * Atomics: Support for 64bit ints. [Jim Jagielski]
  * Add the apr_encode_* API that implements RFC4648 and RFC7515
    compliant BASE64, BASE64URL, BASE32, BASE32HEX and BASE16
    encode/decode functions. [Graham Leggett]
  * rand: Use arc4random_buf() on BSD platforms and getrandom() on Linux,
    when available. [Christian Weisgerber &lt;naddy openbsd.org, Yann Ylavic]
  * Add apr_sockaddr_zone_set, apr_sockaddr_zone_set to set and retrieve
    the zone for link-local IPv6 addresses.  [Joe Orton]
  * apr_sockaddr_equal: Compare link-local IPv6 addresses with different
    zones as not equal.  [Joe Orton]
  * apr_sockaddr_ip_getbuf, apr_sockaddr_ip_get: Append "%zone" for
    IPv6 link-local addresses.  [Joe Orton]
  * Locks: add a --disable-timedlocks config option in case users
    encounter more platforms where it fails [Nick Kew].
  * apr_allocator, apr_pools: Add apr_allocator_page_size() and
    apr_allocator_min_order_set() to respectively get the (system's) page size
    in use and set the minimum allocation size for an allocator (expressed in
    2^order pages).  [Yann Ylavic]
  * locks: provide portable implementations of timedlock()s for
    posix-sems, sysv-sems and pthreads for those platforms that
    lack native versions (eg: OSX/macOS). [Jim Jagielski]
  * locks: Introduce apr_{thread,proc,global}_mutex_timedlock().
    [Yann Ylavic]
- Remove patch
  * apr-use-getrandom.patch no longer needed, apr 1.7.0 use getrandom() on Linux,
    when available.
- Refresh apr-visibility.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1630584000">- security update
- added patches
  fix CVE-2021-35940 [bsc#1190072], Regression of fix in apr 1.7
  + apr-CVE-2021-35940.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191747]</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- deleted patches
  - apr-CVE-2021-3594.patch (renamed)
- added patches
  + apr-CVE-2021-35940.patch (correct name)</changelog>
  <changelog author="coolo@suse.com" date="1648296000">- Remove autoreconf call, it breaks with uptodate autoconf versions</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.7.2:
  * CVE-2022-24963: Integer Overflow or Wraparound vulnerability in
    apr_encode functions allows an attacker to write beyond bounds
    of a buffer (boo#1207870)
  * Add error handling for lseek() failures in apr_file_write() and
    apr_file_writev()
  * Avoid an overflow on 32 bit platforms
  * Don't silently set APR_FOPEN_NOCLEANUP for apr_file_mktemp()
    created file to avoid a fd and inode leak when/if later passed
    to apr_file_setaside().
  * build system fixes and fixes for other platforms
- drop apr-CVE-2021-35940.patch included upstream (CVE-2021-35940)</changelog>
  <changelog author="dmueller@suse.com" date="1681646400">- update to 1.7.3:
  * apr-1-config: Fix crosscompiling detection
  * configure: Add --enable-sysv-shm to use SysV shared
    memory (shmget) if available.
  * apr_socket_sendfile: Use WSAIoctl() to get TransmitFile
    function pointer on Windows. [Ivan Zhakov]
  * apr_dir_read: Do not request short file names on Windows
    7 and later. [Ivan Zhakov]
  * apr_file_gets: Optimize for buffered files on Windows.
  * Fix a deadlock when writing to locked files opened with
    APR_FOPEN_APPEND on Windows. PR 50058. [Evgeny Kotkov]
  * Don't seek to the end when opening files with
    APR_FOPEN_APPEND on Windows.
  * apr_file_write: Optimize large writes to buffered files
    on Windows.
  * apr_file_write: Optimize large reads from buffered files
    on Windows.</changelog>
  <changelog author="pgajdos@suse.com" date="1681992000">- version update to 1.7.4
  * ) Fix a regression where writing to a file opened with both APR_FOPEN_APPEND
    and APR_FOPEN_BUFFERED did not properly append the data on Windows.
    (This regression was introduced in APR 1.7.3)  [Evgeny Kotkov]</changelog>
  <changelog author="bwiedemann@suse.com" date="1702900800">- Add reproducible.patch to drop build host name (boo#1084909)</changelog>
  <changelog author="pgajdos@suse.com" date="1726574400">- version update to 1.7.5 [bsc#1229783] CVE-2023-49582
  * ) Unix: Implement apr_shm_perms_set() for the "POSIX shm_open()"
    and "classic mmap" shared memory implementations.  [Joe Orton,
    Ruediger Pluem]
  * ) Fix missing ';' for XML/HTML hex entities from apr_escape_entity().
    [Yann Ylavic]
  * ) Fix crash in apr_pool_create() with --enable-pool-debug=all|owner.
    [Yann Ylavic]
  * ) Improve platform detection by updating config.guess and config.sub.
    [Rainer Jung]
  * ) CMake: Add support for CMAKE_WARNING_AS_ERROR. [Ivan Zhakov]
  * ) CMake: Enable support for MSVC runtime library selection by abstraction.
    [Ivan Zhakov]
  * ) CMake: Export installed targets (libapr-1, apr-1, libaprapp-1, aprapp-1)
    to apr:: namespace. [Ivan Zhakov]
- modified patches
  % apr-visibility.patch (refreshed)
  % reproducible.patch (refreshed)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1748088000">- update to 1.7.6:
  * build system fixes
  * fixes to regression tests
  * fixes for other platforms</changelog>
</package>
<package pkgid="25e1cc04b68e6bc2ec487e2934d1cf8ba1b3ed4d3b0e555f7c46fc9a06ed649d" name="apr-devel" arch="x86_64">
  <version epoch="0" ver="1.7.6" rel="150600.59.2"/>
  <changelog author="mpluskal@suse.com" date="1508155200">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Do not require python for building - its not needed anyways
  (fate#323526)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1516708800">- ignore PowerPC transient test failures</changelog>
  <changelog author="mliska@suse.cz" date="1524052800">- Add gcc8-integer-overflow.patch to handle an undefined
  behavior (boo#1090085).</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1525953600">- Version 1.6.3:
  * apr_file_trunc: Truncating a buffered file could add unexpected
  data after the truncate position. PR 51017.
  * apr_file_trunc: Fix an issue where reading from a buffered file
  after truncate could return stale data from the buffer.
  * apr_ipsubnet_create() now fails for an empty input string.
- fixes [bsc#1092981]</changelog>
  <changelog author="mmanu84@outlook.de" date="1539864000">- Version 1.6.5
  * Fix Win32 build breakage in apr_os_exp_time_put() in 1.6.4. [Rainer Jung]
- Version 1.6.4
  * configure: Fix detection of &lt;net/if.h&gt; on OpenBSD.
  PR 61976. [David Carlier &lt;devnexen gmail.com&gt;, Yann Ylavic]
  * Fix apr_parse_addr_port() regression in scope_id parsing introduced
  in 1.6.3.  [Rainer Jung]
  * Fix Win32 file buffer locking behavior for single threaded file streams.
  [Evgeny Kotkov, Mladen Turk, Jean-Frederic Clere]
  * Numerous corrections to APR poll behavior. [Yann Ylavic]
- Drop patch gcc8-integer-overflow.patch merged upstream</changelog>
  <changelog author="tchvatal@suse.com" date="1547640000">- Update keyring to match current release maintainer</changelog>
  <changelog author="pgajdos@suse.com" date="1549540800">- linux version is now checked correctly, drop
  - apr-1.4.5-linux3.patch
    (see change log from Sun Aug  7 01:21:44 UTC 2011)</changelog>
  <changelog author="pgajdos@suse.com" date="1549627200">- increase timeout to fix random failure of testsuite
  + apr-test-sendfile-timeout.patch
- fix build for SLE11 again</changelog>
  <changelog author="mmanu84@outlook.de" date="1564833600">- Version 1.7.0
  * apr_dir_read: [Unix] Dropped the preference of the dirread_r() flavor
    for dirread(), because the former is both deprecated and unneeded.
    [Yann Ylavic, William Rowe]
  * apr_file_info: [Win32 only] Treat only "name surrogate" reparse points
    as symlinks, and not other reparse tag types. PR47630
    [Oleg Liatte &lt;olegliatte gmail.com&gt;]
  * Test %ld vs. %lld to avoid compiler emits using APR_OFF_T_FMT, in the
    case of apparently equivilant long and long long types. [William Rowe]
  * Recognize APPLE predefined macros as equivilant to DARWIN. [Jim Jagielski]
  * Signals: Allow handling of SIGUSR2 in apr_signal_thread. [Yann Ylavic]
  * Atomics: Support for 64bit ints. [Jim Jagielski]
  * Add the apr_encode_* API that implements RFC4648 and RFC7515
    compliant BASE64, BASE64URL, BASE32, BASE32HEX and BASE16
    encode/decode functions. [Graham Leggett]
  * rand: Use arc4random_buf() on BSD platforms and getrandom() on Linux,
    when available. [Christian Weisgerber &lt;naddy openbsd.org, Yann Ylavic]
  * Add apr_sockaddr_zone_set, apr_sockaddr_zone_set to set and retrieve
    the zone for link-local IPv6 addresses.  [Joe Orton]
  * apr_sockaddr_equal: Compare link-local IPv6 addresses with different
    zones as not equal.  [Joe Orton]
  * apr_sockaddr_ip_getbuf, apr_sockaddr_ip_get: Append "%zone" for
    IPv6 link-local addresses.  [Joe Orton]
  * Locks: add a --disable-timedlocks config option in case users
    encounter more platforms where it fails [Nick Kew].
  * apr_allocator, apr_pools: Add apr_allocator_page_size() and
    apr_allocator_min_order_set() to respectively get the (system's) page size
    in use and set the minimum allocation size for an allocator (expressed in
    2^order pages).  [Yann Ylavic]
  * locks: provide portable implementations of timedlock()s for
    posix-sems, sysv-sems and pthreads for those platforms that
    lack native versions (eg: OSX/macOS). [Jim Jagielski]
  * locks: Introduce apr_{thread,proc,global}_mutex_timedlock().
    [Yann Ylavic]
- Remove patch
  * apr-use-getrandom.patch no longer needed, apr 1.7.0 use getrandom() on Linux,
    when available.
- Refresh apr-visibility.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1630584000">- security update
- added patches
  fix CVE-2021-35940 [bsc#1190072], Regression of fix in apr 1.7
  + apr-CVE-2021-35940.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191747]</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- deleted patches
  - apr-CVE-2021-3594.patch (renamed)
- added patches
  + apr-CVE-2021-35940.patch (correct name)</changelog>
  <changelog author="coolo@suse.com" date="1648296000">- Remove autoreconf call, it breaks with uptodate autoconf versions</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.7.2:
  * CVE-2022-24963: Integer Overflow or Wraparound vulnerability in
    apr_encode functions allows an attacker to write beyond bounds
    of a buffer (boo#1207870)
  * Add error handling for lseek() failures in apr_file_write() and
    apr_file_writev()
  * Avoid an overflow on 32 bit platforms
  * Don't silently set APR_FOPEN_NOCLEANUP for apr_file_mktemp()
    created file to avoid a fd and inode leak when/if later passed
    to apr_file_setaside().
  * build system fixes and fixes for other platforms
- drop apr-CVE-2021-35940.patch included upstream (CVE-2021-35940)</changelog>
  <changelog author="dmueller@suse.com" date="1681646400">- update to 1.7.3:
  * apr-1-config: Fix crosscompiling detection
  * configure: Add --enable-sysv-shm to use SysV shared
    memory (shmget) if available.
  * apr_socket_sendfile: Use WSAIoctl() to get TransmitFile
    function pointer on Windows. [Ivan Zhakov]
  * apr_dir_read: Do not request short file names on Windows
    7 and later. [Ivan Zhakov]
  * apr_file_gets: Optimize for buffered files on Windows.
  * Fix a deadlock when writing to locked files opened with
    APR_FOPEN_APPEND on Windows. PR 50058. [Evgeny Kotkov]
  * Don't seek to the end when opening files with
    APR_FOPEN_APPEND on Windows.
  * apr_file_write: Optimize large writes to buffered files
    on Windows.
  * apr_file_write: Optimize large reads from buffered files
    on Windows.</changelog>
  <changelog author="pgajdos@suse.com" date="1681992000">- version update to 1.7.4
  * ) Fix a regression where writing to a file opened with both APR_FOPEN_APPEND
    and APR_FOPEN_BUFFERED did not properly append the data on Windows.
    (This regression was introduced in APR 1.7.3)  [Evgeny Kotkov]</changelog>
  <changelog author="bwiedemann@suse.com" date="1702900800">- Add reproducible.patch to drop build host name (boo#1084909)</changelog>
  <changelog author="pgajdos@suse.com" date="1726574400">- version update to 1.7.5 [bsc#1229783] CVE-2023-49582
  * ) Unix: Implement apr_shm_perms_set() for the "POSIX shm_open()"
    and "classic mmap" shared memory implementations.  [Joe Orton,
    Ruediger Pluem]
  * ) Fix missing ';' for XML/HTML hex entities from apr_escape_entity().
    [Yann Ylavic]
  * ) Fix crash in apr_pool_create() with --enable-pool-debug=all|owner.
    [Yann Ylavic]
  * ) Improve platform detection by updating config.guess and config.sub.
    [Rainer Jung]
  * ) CMake: Add support for CMAKE_WARNING_AS_ERROR. [Ivan Zhakov]
  * ) CMake: Enable support for MSVC runtime library selection by abstraction.
    [Ivan Zhakov]
  * ) CMake: Export installed targets (libapr-1, apr-1, libaprapp-1, aprapp-1)
    to apr:: namespace. [Ivan Zhakov]
- modified patches
  % apr-visibility.patch (refreshed)
  % reproducible.patch (refreshed)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1748088000">- update to 1.7.6:
  * build system fixes
  * fixes to regression tests
  * fixes for other platforms</changelog>
</package>
<package pkgid="f80f0a103a38681c41d62df0f217121a07ec1b380c7f6e062811bd3677b44f33" name="apr-util" arch="src">
  <version epoch="0" ver="1.6.3" rel="150600.49.1"/>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598961600">- drop dependency on Berkeley DB [jsc#SLE-12211], gdbm DBM connector
  is now built instead and sdbm works as well
  * added patches
  https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191748]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640088000">- add upstream signing key (taken from apr package) and validate
  source signature
- run spec-cleaner and mark license files as %license</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.6.3
  * CVE-2022-25147: Integer Overflow or Wraparound vulnerability in
    apr_base64 function allows an attacker to write beyond bounds
    of a buffer (boo#1207866)
  * build system updates
- drop patches now included upstream:
  * apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch
  * apr-util-mariadb-10.2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1730376000">- Fix dependency on libapr: in 2021, libapr1 was renamed to
  libapr1-0, conforming to the shared library packaging policy.
  requires_eq silently dropped the dependency, as the packahe name,
  libapr1, does not exist.</changelog>
  <changelog author="dimstar@opensuse.org" date="1777982400">- requires_ge takes a package name as parameter, not a full
  NVR.arch string (that just happens to work sometimes): Fix by
  passing '--qf "%%{name}' to the rpm call identifying the target
  package name.</changelog>
</package>
<package pkgid="43d8e5fa58b5dcb4e6d2d56db0b9a168d33e623f1dfdbe33158e2d5f50248991" name="apr-util-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.6.3" rel="150600.49.1"/>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598961600">- drop dependency on Berkeley DB [jsc#SLE-12211], gdbm DBM connector
  is now built instead and sdbm works as well
  * added patches
  https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191748]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640088000">- add upstream signing key (taken from apr package) and validate
  source signature
- run spec-cleaner and mark license files as %license</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.6.3
  * CVE-2022-25147: Integer Overflow or Wraparound vulnerability in
    apr_base64 function allows an attacker to write beyond bounds
    of a buffer (boo#1207866)
  * build system updates
- drop patches now included upstream:
  * apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch
  * apr-util-mariadb-10.2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1730376000">- Fix dependency on libapr: in 2021, libapr1 was renamed to
  libapr1-0, conforming to the shared library packaging policy.
  requires_eq silently dropped the dependency, as the packahe name,
  libapr1, does not exist.</changelog>
  <changelog author="dimstar@opensuse.org" date="1777982400">- requires_ge takes a package name as parameter, not a full
  NVR.arch string (that just happens to work sometimes): Fix by
  passing '--qf "%%{name}' to the rpm call identifying the target
  package name.</changelog>
</package>
<package pkgid="f7c5ee9b4f8336a9d86d05e82e8fbf0dc330344e70488f3c609e03068bde64c9" name="apr-util-debugsource" arch="x86_64">
  <version epoch="0" ver="1.6.3" rel="150600.49.1"/>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598961600">- drop dependency on Berkeley DB [jsc#SLE-12211], gdbm DBM connector
  is now built instead and sdbm works as well
  * added patches
  https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191748]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640088000">- add upstream signing key (taken from apr package) and validate
  source signature
- run spec-cleaner and mark license files as %license</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.6.3
  * CVE-2022-25147: Integer Overflow or Wraparound vulnerability in
    apr_base64 function allows an attacker to write beyond bounds
    of a buffer (boo#1207866)
  * build system updates
- drop patches now included upstream:
  * apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch
  * apr-util-mariadb-10.2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1730376000">- Fix dependency on libapr: in 2021, libapr1 was renamed to
  libapr1-0, conforming to the shared library packaging policy.
  requires_eq silently dropped the dependency, as the packahe name,
  libapr1, does not exist.</changelog>
  <changelog author="dimstar@opensuse.org" date="1777982400">- requires_ge takes a package name as parameter, not a full
  NVR.arch string (that just happens to work sometimes): Fix by
  passing '--qf "%%{name}' to the rpm call identifying the target
  package name.</changelog>
</package>
<package pkgid="1dff672f7ee04529791a5b8c74bc605870240d5a8c3b9e77f5192ea542fad938" name="apr-util-devel" arch="x86_64">
  <version epoch="0" ver="1.6.3" rel="150600.49.1"/>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598961600">- drop dependency on Berkeley DB [jsc#SLE-12211], gdbm DBM connector
  is now built instead and sdbm works as well
  * added patches
  https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191748]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640088000">- add upstream signing key (taken from apr package) and validate
  source signature
- run spec-cleaner and mark license files as %license</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.6.3
  * CVE-2022-25147: Integer Overflow or Wraparound vulnerability in
    apr_base64 function allows an attacker to write beyond bounds
    of a buffer (boo#1207866)
  * build system updates
- drop patches now included upstream:
  * apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch
  * apr-util-mariadb-10.2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1730376000">- Fix dependency on libapr: in 2021, libapr1 was renamed to
  libapr1-0, conforming to the shared library packaging policy.
  requires_eq silently dropped the dependency, as the packahe name,
  libapr1, does not exist.</changelog>
  <changelog author="dimstar@opensuse.org" date="1777982400">- requires_ge takes a package name as parameter, not a full
  NVR.arch string (that just happens to work sometimes): Fix by
  passing '--qf "%%{name}' to the rpm call identifying the target
  package name.</changelog>
</package>
<package pkgid="a9054b326d4c7b32a48da104b0e371e68f21def3688b6de03c3052e684c96a43" name="cronolog" arch="src">
  <version epoch="0" ver="1.7.0" rel="150600.14.2"/>
  <changelog author="poeml@suse.de" date="1173441600">- initial package, 1.6.2, copied from fedora-core-extras 6</changelog>
  <changelog author="poeml@suse.de" date="1173960000">- update to 1.7.0-beta</changelog>
  <changelog author="poeml@suse.de" date="1236254400">- add cronolog-1.7.0-strncat-compilefix.patch, which fixes a
  compiler warning about strncat usage with possible buffer
  overflow (when parsing commandline arguments)</changelog>
  <changelog author="poeml@suse.de" date="1245326400">- increase the release counter, so that the package is updated on
  machines that had it already before its move from home:poeml to
  server:http in the openSUSE buildservice.</changelog>
  <changelog author="lars@linux-schulserver.de - 1.7.0" date="1575288000">- spec file cleanup:
  + added preamble
  + use spdx license as string
  + use the same package group as logrotate
- refreshed cronolog-1.7.0-strncat-compilefix.patch
- added new patches (stolen from Debian package):
  + cronolog_avoid_empty_filename.patch
  + cronolog_-_cronosplit.patch
  + cronolog_manpage.patch</changelog>
  <changelog author="mail+rpm@georg-pfuetzenreuter.net" date="1759233600">- Clean up and modernize spec file:
  * switch to autosetup
  * remove obsolete sections
  * explicitly package files
- Repair build for Leap 16</changelog>
</package>
<package pkgid="3b7d1e39037ca272ec9b8afda356575d4eedfcfcd8c81c59ca909639c3aeb205" name="cronolog" arch="x86_64">
  <version epoch="0" ver="1.7.0" rel="150600.14.2"/>
  <changelog author="poeml@suse.de" date="1173441600">- initial package, 1.6.2, copied from fedora-core-extras 6</changelog>
  <changelog author="poeml@suse.de" date="1173960000">- update to 1.7.0-beta</changelog>
  <changelog author="poeml@suse.de" date="1236254400">- add cronolog-1.7.0-strncat-compilefix.patch, which fixes a
  compiler warning about strncat usage with possible buffer
  overflow (when parsing commandline arguments)</changelog>
  <changelog author="poeml@suse.de" date="1245326400">- increase the release counter, so that the package is updated on
  machines that had it already before its move from home:poeml to
  server:http in the openSUSE buildservice.</changelog>
  <changelog author="lars@linux-schulserver.de - 1.7.0" date="1575288000">- spec file cleanup:
  + added preamble
  + use spdx license as string
  + use the same package group as logrotate
- refreshed cronolog-1.7.0-strncat-compilefix.patch
- added new patches (stolen from Debian package):
  + cronolog_avoid_empty_filename.patch
  + cronolog_-_cronosplit.patch
  + cronolog_manpage.patch</changelog>
  <changelog author="mail+rpm@georg-pfuetzenreuter.net" date="1759233600">- Clean up and modernize spec file:
  * switch to autosetup
  * remove obsolete sections
  * explicitly package files
- Repair build for Leap 16</changelog>
</package>
<package pkgid="1080456226078a62f2a99ac432535d54c447af47250b288f38d724c64860cace" name="cronolog-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.7.0" rel="150600.14.2"/>
  <changelog author="poeml@suse.de" date="1173441600">- initial package, 1.6.2, copied from fedora-core-extras 6</changelog>
  <changelog author="poeml@suse.de" date="1173960000">- update to 1.7.0-beta</changelog>
  <changelog author="poeml@suse.de" date="1236254400">- add cronolog-1.7.0-strncat-compilefix.patch, which fixes a
  compiler warning about strncat usage with possible buffer
  overflow (when parsing commandline arguments)</changelog>
  <changelog author="poeml@suse.de" date="1245326400">- increase the release counter, so that the package is updated on
  machines that had it already before its move from home:poeml to
  server:http in the openSUSE buildservice.</changelog>
  <changelog author="lars@linux-schulserver.de - 1.7.0" date="1575288000">- spec file cleanup:
  + added preamble
  + use spdx license as string
  + use the same package group as logrotate
- refreshed cronolog-1.7.0-strncat-compilefix.patch
- added new patches (stolen from Debian package):
  + cronolog_avoid_empty_filename.patch
  + cronolog_-_cronosplit.patch
  + cronolog_manpage.patch</changelog>
  <changelog author="mail+rpm@georg-pfuetzenreuter.net" date="1759233600">- Clean up and modernize spec file:
  * switch to autosetup
  * remove obsolete sections
  * explicitly package files
- Repair build for Leap 16</changelog>
</package>
<package pkgid="7ba1cae4aacf817fb03e071681b7e44baba4d833c54a3b437a7898b020d1906a" name="cronolog-debugsource" arch="x86_64">
  <version epoch="0" ver="1.7.0" rel="150600.14.2"/>
  <changelog author="poeml@suse.de" date="1173441600">- initial package, 1.6.2, copied from fedora-core-extras 6</changelog>
  <changelog author="poeml@suse.de" date="1173960000">- update to 1.7.0-beta</changelog>
  <changelog author="poeml@suse.de" date="1236254400">- add cronolog-1.7.0-strncat-compilefix.patch, which fixes a
  compiler warning about strncat usage with possible buffer
  overflow (when parsing commandline arguments)</changelog>
  <changelog author="poeml@suse.de" date="1245326400">- increase the release counter, so that the package is updated on
  machines that had it already before its move from home:poeml to
  server:http in the openSUSE buildservice.</changelog>
  <changelog author="lars@linux-schulserver.de - 1.7.0" date="1575288000">- spec file cleanup:
  + added preamble
  + use spdx license as string
  + use the same package group as logrotate
- refreshed cronolog-1.7.0-strncat-compilefix.patch
- added new patches (stolen from Debian package):
  + cronolog_avoid_empty_filename.patch
  + cronolog_-_cronosplit.patch
  + cronolog_manpage.patch</changelog>
  <changelog author="mail+rpm@georg-pfuetzenreuter.net" date="1759233600">- Clean up and modernize spec file:
  * switch to autosetup
  * remove obsolete sections
  * explicitly package files
- Repair build for Leap 16</changelog>
</package>
<package pkgid="16aebd9fc6ce9af02d4a19dd2d0ca239927625c3ed907e807db55256136adffb" name="libapr-util1-0" arch="x86_64">
  <version epoch="0" ver="1.6.3" rel="150600.49.1"/>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598961600">- drop dependency on Berkeley DB [jsc#SLE-12211], gdbm DBM connector
  is now built instead and sdbm works as well
  * added patches
  https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191748]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640088000">- add upstream signing key (taken from apr package) and validate
  source signature
- run spec-cleaner and mark license files as %license</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.6.3
  * CVE-2022-25147: Integer Overflow or Wraparound vulnerability in
    apr_base64 function allows an attacker to write beyond bounds
    of a buffer (boo#1207866)
  * build system updates
- drop patches now included upstream:
  * apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch
  * apr-util-mariadb-10.2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1730376000">- Fix dependency on libapr: in 2021, libapr1 was renamed to
  libapr1-0, conforming to the shared library packaging policy.
  requires_eq silently dropped the dependency, as the packahe name,
  libapr1, does not exist.</changelog>
  <changelog author="dimstar@opensuse.org" date="1777982400">- requires_ge takes a package name as parameter, not a full
  NVR.arch string (that just happens to work sometimes): Fix by
  passing '--qf "%%{name}' to the rpm call identifying the target
  package name.</changelog>
</package>
<package pkgid="6606d1fa03334239a590492511bdbf9f139af66c1120c045e889400014975a83" name="libapr-util1-0-dbd-mysql" arch="x86_64">
  <version epoch="0" ver="1.6.3" rel="150600.49.1"/>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598961600">- drop dependency on Berkeley DB [jsc#SLE-12211], gdbm DBM connector
  is now built instead and sdbm works as well
  * added patches
  https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191748]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640088000">- add upstream signing key (taken from apr package) and validate
  source signature
- run spec-cleaner and mark license files as %license</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.6.3
  * CVE-2022-25147: Integer Overflow or Wraparound vulnerability in
    apr_base64 function allows an attacker to write beyond bounds
    of a buffer (boo#1207866)
  * build system updates
- drop patches now included upstream:
  * apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch
  * apr-util-mariadb-10.2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1730376000">- Fix dependency on libapr: in 2021, libapr1 was renamed to
  libapr1-0, conforming to the shared library packaging policy.
  requires_eq silently dropped the dependency, as the packahe name,
  libapr1, does not exist.</changelog>
  <changelog author="dimstar@opensuse.org" date="1777982400">- requires_ge takes a package name as parameter, not a full
  NVR.arch string (that just happens to work sometimes): Fix by
  passing '--qf "%%{name}' to the rpm call identifying the target
  package name.</changelog>
</package>
<package pkgid="72ae4fd60c64473fff7c4078c6940a631622352a22deda3c2f23419911748db5" name="libapr-util1-0-dbd-mysql-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.6.3" rel="150600.49.1"/>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598961600">- drop dependency on Berkeley DB [jsc#SLE-12211], gdbm DBM connector
  is now built instead and sdbm works as well
  * added patches
  https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191748]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640088000">- add upstream signing key (taken from apr package) and validate
  source signature
- run spec-cleaner and mark license files as %license</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.6.3
  * CVE-2022-25147: Integer Overflow or Wraparound vulnerability in
    apr_base64 function allows an attacker to write beyond bounds
    of a buffer (boo#1207866)
  * build system updates
- drop patches now included upstream:
  * apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch
  * apr-util-mariadb-10.2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1730376000">- Fix dependency on libapr: in 2021, libapr1 was renamed to
  libapr1-0, conforming to the shared library packaging policy.
  requires_eq silently dropped the dependency, as the packahe name,
  libapr1, does not exist.</changelog>
  <changelog author="dimstar@opensuse.org" date="1777982400">- requires_ge takes a package name as parameter, not a full
  NVR.arch string (that just happens to work sometimes): Fix by
  passing '--qf "%%{name}' to the rpm call identifying the target
  package name.</changelog>
</package>
<package pkgid="284ca1754522a49d36887023cde90ddb21b02b02f1b1cc672a7f9679f3c51785" name="libapr-util1-0-dbd-pgsql" arch="x86_64">
  <version epoch="0" ver="1.6.3" rel="150600.49.1"/>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598961600">- drop dependency on Berkeley DB [jsc#SLE-12211], gdbm DBM connector
  is now built instead and sdbm works as well
  * added patches
  https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191748]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640088000">- add upstream signing key (taken from apr package) and validate
  source signature
- run spec-cleaner and mark license files as %license</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.6.3
  * CVE-2022-25147: Integer Overflow or Wraparound vulnerability in
    apr_base64 function allows an attacker to write beyond bounds
    of a buffer (boo#1207866)
  * build system updates
- drop patches now included upstream:
  * apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch
  * apr-util-mariadb-10.2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1730376000">- Fix dependency on libapr: in 2021, libapr1 was renamed to
  libapr1-0, conforming to the shared library packaging policy.
  requires_eq silently dropped the dependency, as the packahe name,
  libapr1, does not exist.</changelog>
  <changelog author="dimstar@opensuse.org" date="1777982400">- requires_ge takes a package name as parameter, not a full
  NVR.arch string (that just happens to work sometimes): Fix by
  passing '--qf "%%{name}' to the rpm call identifying the target
  package name.</changelog>
</package>
<package pkgid="8d49c3801427285909d0caa7ff0e819ca985fa7ac7376b7452422ed0543c7266" name="libapr-util1-0-dbd-pgsql-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.6.3" rel="150600.49.1"/>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598961600">- drop dependency on Berkeley DB [jsc#SLE-12211], gdbm DBM connector
  is now built instead and sdbm works as well
  * added patches
  https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191748]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640088000">- add upstream signing key (taken from apr package) and validate
  source signature
- run spec-cleaner and mark license files as %license</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.6.3
  * CVE-2022-25147: Integer Overflow or Wraparound vulnerability in
    apr_base64 function allows an attacker to write beyond bounds
    of a buffer (boo#1207866)
  * build system updates
- drop patches now included upstream:
  * apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch
  * apr-util-mariadb-10.2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1730376000">- Fix dependency on libapr: in 2021, libapr1 was renamed to
  libapr1-0, conforming to the shared library packaging policy.
  requires_eq silently dropped the dependency, as the packahe name,
  libapr1, does not exist.</changelog>
  <changelog author="dimstar@opensuse.org" date="1777982400">- requires_ge takes a package name as parameter, not a full
  NVR.arch string (that just happens to work sometimes): Fix by
  passing '--qf "%%{name}' to the rpm call identifying the target
  package name.</changelog>
</package>
<package pkgid="2e72191e947b83125c3b58aa00a4c45b56aa38206f8d6c9c48aa1eb4a80d7efb" name="libapr-util1-0-dbd-sqlite3" arch="x86_64">
  <version epoch="0" ver="1.6.3" rel="150600.49.1"/>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598961600">- drop dependency on Berkeley DB [jsc#SLE-12211], gdbm DBM connector
  is now built instead and sdbm works as well
  * added patches
  https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191748]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640088000">- add upstream signing key (taken from apr package) and validate
  source signature
- run spec-cleaner and mark license files as %license</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.6.3
  * CVE-2022-25147: Integer Overflow or Wraparound vulnerability in
    apr_base64 function allows an attacker to write beyond bounds
    of a buffer (boo#1207866)
  * build system updates
- drop patches now included upstream:
  * apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch
  * apr-util-mariadb-10.2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1730376000">- Fix dependency on libapr: in 2021, libapr1 was renamed to
  libapr1-0, conforming to the shared library packaging policy.
  requires_eq silently dropped the dependency, as the packahe name,
  libapr1, does not exist.</changelog>
  <changelog author="dimstar@opensuse.org" date="1777982400">- requires_ge takes a package name as parameter, not a full
  NVR.arch string (that just happens to work sometimes): Fix by
  passing '--qf "%%{name}' to the rpm call identifying the target
  package name.</changelog>
</package>
<package pkgid="80432e21cba916e09d830609815ac90c73190ee41b14afa7eeea027e38a9de59" name="libapr-util1-0-dbd-sqlite3-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.6.3" rel="150600.49.1"/>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598961600">- drop dependency on Berkeley DB [jsc#SLE-12211], gdbm DBM connector
  is now built instead and sdbm works as well
  * added patches
  https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191748]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640088000">- add upstream signing key (taken from apr package) and validate
  source signature
- run spec-cleaner and mark license files as %license</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.6.3
  * CVE-2022-25147: Integer Overflow or Wraparound vulnerability in
    apr_base64 function allows an attacker to write beyond bounds
    of a buffer (boo#1207866)
  * build system updates
- drop patches now included upstream:
  * apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch
  * apr-util-mariadb-10.2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1730376000">- Fix dependency on libapr: in 2021, libapr1 was renamed to
  libapr1-0, conforming to the shared library packaging policy.
  requires_eq silently dropped the dependency, as the packahe name,
  libapr1, does not exist.</changelog>
  <changelog author="dimstar@opensuse.org" date="1777982400">- requires_ge takes a package name as parameter, not a full
  NVR.arch string (that just happens to work sometimes): Fix by
  passing '--qf "%%{name}' to the rpm call identifying the target
  package name.</changelog>
</package>
<package pkgid="e3131f0ec7c48db0fe0d929f61f0bc9856a4e5d2817485bab3867efe952ade69" name="libapr-util1-0-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.6.3" rel="150600.49.1"/>
  <changelog author="coolo@suse.com" date="1413633600">- fix requires after spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1444737600">- require postgresql-devel version at least 9.1.0 to fix build for
  SLE-11-SP4</changelog>
  <changelog author="pgajdos@suse.com" date="1454587200">- require postgresql-devel less then 9.4 to fix build on SLE_12
  and SLE_12_SP1</changelog>
  <changelog author="pgajdos@suse.com" date="1460030400">- require just posgresql-devel everywhere, it seems to work now</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- APR-util 1.6.0
  * Update MySQL build to stop using libmysqlclient_r
  * apr_siphash: Implement keyed hash function SipHash
  * apr_buckets: Add apr_bucket_file_set_buf_size()
  * apr_crypto: avoid excessive iteration in bcrypt hash.
  * apr_xml_to_text: Add style APR_XML_X2T_PARSED.
  * see http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 for
  extra details</changelog>
  <changelog author="mpluskal@suse.com" date="1499860800">- Rename package to apr-util
- Drop baselib.conf as it does not target any supported
  architecture</changelog>
  <changelog author="jengelh@inai.de" date="1500292800">- Replace unusual *.?a match by *.la.
- Fix RPM groups, diversify summaries.</changelog>
  <changelog author="mpluskal@suse.com" date="1508241600">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="kstreitova@suse.com" date="1510056000">- APR-util 1.6.1
  * apr_crypto: Fix compatibility with LibreSSL. PR 61596.
  * sdbm: better database/page validation to fail cleanly when
    corrupted [bsc#1064990], CVE-2017-12618</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Add apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2.</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- extend apr-util-mariadb-10.2.patch: Fix detection / build with
  MariaDB 10.2. [bsc#1094754]</changelog>
  <changelog author="vcizek@suse.com" date="1537790400">- Add missing zlib-devel build dependency which used to be pulled in
  by libopenssl-devel</changelog>
  <changelog author="max@suse.com" date="1551787200">- apr-util-postgresql.patch: PostrgeSQL's pg_config is meant for
  linking server extensions, use libpq's pkg-config, if pg_config
  is missing. This fixes build with PostgreSQL 11.</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- fix linking with libpq
- modified patches
  % apr-util-postgresql.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598961600">- drop dependency on Berkeley DB [jsc#SLE-12211], gdbm DBM connector
  is now built instead and sdbm works as well
  * added patches
  https://svn.apache.org/viewvc?view=revision&amp;revision=1825312
  + apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191748]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640088000">- add upstream signing key (taken from apr package) and validate
  source signature
- run spec-cleaner and mark license files as %license</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.6.3
  * CVE-2022-25147: Integer Overflow or Wraparound vulnerability in
    apr_base64 function allows an attacker to write beyond bounds
    of a buffer (boo#1207866)
  * build system updates
- drop patches now included upstream:
  * apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch
  * apr-util-mariadb-10.2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1730376000">- Fix dependency on libapr: in 2021, libapr1 was renamed to
  libapr1-0, conforming to the shared library packaging policy.
  requires_eq silently dropped the dependency, as the packahe name,
  libapr1, does not exist.</changelog>
  <changelog author="dimstar@opensuse.org" date="1777982400">- requires_ge takes a package name as parameter, not a full
  NVR.arch string (that just happens to work sometimes): Fix by
  passing '--qf "%%{name}' to the rpm call identifying the target
  package name.</changelog>
</package>
<package pkgid="b498a7376b7f05d6be09006e191f4c2baac77725145f9b96b62e9d3dce500bd6" name="libapr1-0" arch="x86_64">
  <version epoch="0" ver="1.7.6" rel="150600.59.2"/>
  <changelog author="mpluskal@suse.com" date="1508155200">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Do not require python for building - its not needed anyways
  (fate#323526)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1516708800">- ignore PowerPC transient test failures</changelog>
  <changelog author="mliska@suse.cz" date="1524052800">- Add gcc8-integer-overflow.patch to handle an undefined
  behavior (boo#1090085).</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1525953600">- Version 1.6.3:
  * apr_file_trunc: Truncating a buffered file could add unexpected
  data after the truncate position. PR 51017.
  * apr_file_trunc: Fix an issue where reading from a buffered file
  after truncate could return stale data from the buffer.
  * apr_ipsubnet_create() now fails for an empty input string.
- fixes [bsc#1092981]</changelog>
  <changelog author="mmanu84@outlook.de" date="1539864000">- Version 1.6.5
  * Fix Win32 build breakage in apr_os_exp_time_put() in 1.6.4. [Rainer Jung]
- Version 1.6.4
  * configure: Fix detection of &lt;net/if.h&gt; on OpenBSD.
  PR 61976. [David Carlier &lt;devnexen gmail.com&gt;, Yann Ylavic]
  * Fix apr_parse_addr_port() regression in scope_id parsing introduced
  in 1.6.3.  [Rainer Jung]
  * Fix Win32 file buffer locking behavior for single threaded file streams.
  [Evgeny Kotkov, Mladen Turk, Jean-Frederic Clere]
  * Numerous corrections to APR poll behavior. [Yann Ylavic]
- Drop patch gcc8-integer-overflow.patch merged upstream</changelog>
  <changelog author="tchvatal@suse.com" date="1547640000">- Update keyring to match current release maintainer</changelog>
  <changelog author="pgajdos@suse.com" date="1549540800">- linux version is now checked correctly, drop
  - apr-1.4.5-linux3.patch
    (see change log from Sun Aug  7 01:21:44 UTC 2011)</changelog>
  <changelog author="pgajdos@suse.com" date="1549627200">- increase timeout to fix random failure of testsuite
  + apr-test-sendfile-timeout.patch
- fix build for SLE11 again</changelog>
  <changelog author="mmanu84@outlook.de" date="1564833600">- Version 1.7.0
  * apr_dir_read: [Unix] Dropped the preference of the dirread_r() flavor
    for dirread(), because the former is both deprecated and unneeded.
    [Yann Ylavic, William Rowe]
  * apr_file_info: [Win32 only] Treat only "name surrogate" reparse points
    as symlinks, and not other reparse tag types. PR47630
    [Oleg Liatte &lt;olegliatte gmail.com&gt;]
  * Test %ld vs. %lld to avoid compiler emits using APR_OFF_T_FMT, in the
    case of apparently equivilant long and long long types. [William Rowe]
  * Recognize APPLE predefined macros as equivilant to DARWIN. [Jim Jagielski]
  * Signals: Allow handling of SIGUSR2 in apr_signal_thread. [Yann Ylavic]
  * Atomics: Support for 64bit ints. [Jim Jagielski]
  * Add the apr_encode_* API that implements RFC4648 and RFC7515
    compliant BASE64, BASE64URL, BASE32, BASE32HEX and BASE16
    encode/decode functions. [Graham Leggett]
  * rand: Use arc4random_buf() on BSD platforms and getrandom() on Linux,
    when available. [Christian Weisgerber &lt;naddy openbsd.org, Yann Ylavic]
  * Add apr_sockaddr_zone_set, apr_sockaddr_zone_set to set and retrieve
    the zone for link-local IPv6 addresses.  [Joe Orton]
  * apr_sockaddr_equal: Compare link-local IPv6 addresses with different
    zones as not equal.  [Joe Orton]
  * apr_sockaddr_ip_getbuf, apr_sockaddr_ip_get: Append "%zone" for
    IPv6 link-local addresses.  [Joe Orton]
  * Locks: add a --disable-timedlocks config option in case users
    encounter more platforms where it fails [Nick Kew].
  * apr_allocator, apr_pools: Add apr_allocator_page_size() and
    apr_allocator_min_order_set() to respectively get the (system's) page size
    in use and set the minimum allocation size for an allocator (expressed in
    2^order pages).  [Yann Ylavic]
  * locks: provide portable implementations of timedlock()s for
    posix-sems, sysv-sems and pthreads for those platforms that
    lack native versions (eg: OSX/macOS). [Jim Jagielski]
  * locks: Introduce apr_{thread,proc,global}_mutex_timedlock().
    [Yann Ylavic]
- Remove patch
  * apr-use-getrandom.patch no longer needed, apr 1.7.0 use getrandom() on Linux,
    when available.
- Refresh apr-visibility.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1630584000">- security update
- added patches
  fix CVE-2021-35940 [bsc#1190072], Regression of fix in apr 1.7
  + apr-CVE-2021-35940.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191747]</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- deleted patches
  - apr-CVE-2021-3594.patch (renamed)
- added patches
  + apr-CVE-2021-35940.patch (correct name)</changelog>
  <changelog author="coolo@suse.com" date="1648296000">- Remove autoreconf call, it breaks with uptodate autoconf versions</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.7.2:
  * CVE-2022-24963: Integer Overflow or Wraparound vulnerability in
    apr_encode functions allows an attacker to write beyond bounds
    of a buffer (boo#1207870)
  * Add error handling for lseek() failures in apr_file_write() and
    apr_file_writev()
  * Avoid an overflow on 32 bit platforms
  * Don't silently set APR_FOPEN_NOCLEANUP for apr_file_mktemp()
    created file to avoid a fd and inode leak when/if later passed
    to apr_file_setaside().
  * build system fixes and fixes for other platforms
- drop apr-CVE-2021-35940.patch included upstream (CVE-2021-35940)</changelog>
  <changelog author="dmueller@suse.com" date="1681646400">- update to 1.7.3:
  * apr-1-config: Fix crosscompiling detection
  * configure: Add --enable-sysv-shm to use SysV shared
    memory (shmget) if available.
  * apr_socket_sendfile: Use WSAIoctl() to get TransmitFile
    function pointer on Windows. [Ivan Zhakov]
  * apr_dir_read: Do not request short file names on Windows
    7 and later. [Ivan Zhakov]
  * apr_file_gets: Optimize for buffered files on Windows.
  * Fix a deadlock when writing to locked files opened with
    APR_FOPEN_APPEND on Windows. PR 50058. [Evgeny Kotkov]
  * Don't seek to the end when opening files with
    APR_FOPEN_APPEND on Windows.
  * apr_file_write: Optimize large writes to buffered files
    on Windows.
  * apr_file_write: Optimize large reads from buffered files
    on Windows.</changelog>
  <changelog author="pgajdos@suse.com" date="1681992000">- version update to 1.7.4
  * ) Fix a regression where writing to a file opened with both APR_FOPEN_APPEND
    and APR_FOPEN_BUFFERED did not properly append the data on Windows.
    (This regression was introduced in APR 1.7.3)  [Evgeny Kotkov]</changelog>
  <changelog author="bwiedemann@suse.com" date="1702900800">- Add reproducible.patch to drop build host name (boo#1084909)</changelog>
  <changelog author="pgajdos@suse.com" date="1726574400">- version update to 1.7.5 [bsc#1229783] CVE-2023-49582
  * ) Unix: Implement apr_shm_perms_set() for the "POSIX shm_open()"
    and "classic mmap" shared memory implementations.  [Joe Orton,
    Ruediger Pluem]
  * ) Fix missing ';' for XML/HTML hex entities from apr_escape_entity().
    [Yann Ylavic]
  * ) Fix crash in apr_pool_create() with --enable-pool-debug=all|owner.
    [Yann Ylavic]
  * ) Improve platform detection by updating config.guess and config.sub.
    [Rainer Jung]
  * ) CMake: Add support for CMAKE_WARNING_AS_ERROR. [Ivan Zhakov]
  * ) CMake: Enable support for MSVC runtime library selection by abstraction.
    [Ivan Zhakov]
  * ) CMake: Export installed targets (libapr-1, apr-1, libaprapp-1, aprapp-1)
    to apr:: namespace. [Ivan Zhakov]
- modified patches
  % apr-visibility.patch (refreshed)
  % reproducible.patch (refreshed)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1748088000">- update to 1.7.6:
  * build system fixes
  * fixes to regression tests
  * fixes for other platforms</changelog>
</package>
<package pkgid="50fadc87725543df99aeab699b8df0417cb96da103c2c0bfde752de46f2cd2f8" name="libapr1-0-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.7.6" rel="150600.59.2"/>
  <changelog author="mpluskal@suse.com" date="1508155200">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Do not require python for building - its not needed anyways
  (fate#323526)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1516708800">- ignore PowerPC transient test failures</changelog>
  <changelog author="mliska@suse.cz" date="1524052800">- Add gcc8-integer-overflow.patch to handle an undefined
  behavior (boo#1090085).</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1525953600">- Version 1.6.3:
  * apr_file_trunc: Truncating a buffered file could add unexpected
  data after the truncate position. PR 51017.
  * apr_file_trunc: Fix an issue where reading from a buffered file
  after truncate could return stale data from the buffer.
  * apr_ipsubnet_create() now fails for an empty input string.
- fixes [bsc#1092981]</changelog>
  <changelog author="mmanu84@outlook.de" date="1539864000">- Version 1.6.5
  * Fix Win32 build breakage in apr_os_exp_time_put() in 1.6.4. [Rainer Jung]
- Version 1.6.4
  * configure: Fix detection of &lt;net/if.h&gt; on OpenBSD.
  PR 61976. [David Carlier &lt;devnexen gmail.com&gt;, Yann Ylavic]
  * Fix apr_parse_addr_port() regression in scope_id parsing introduced
  in 1.6.3.  [Rainer Jung]
  * Fix Win32 file buffer locking behavior for single threaded file streams.
  [Evgeny Kotkov, Mladen Turk, Jean-Frederic Clere]
  * Numerous corrections to APR poll behavior. [Yann Ylavic]
- Drop patch gcc8-integer-overflow.patch merged upstream</changelog>
  <changelog author="tchvatal@suse.com" date="1547640000">- Update keyring to match current release maintainer</changelog>
  <changelog author="pgajdos@suse.com" date="1549540800">- linux version is now checked correctly, drop
  - apr-1.4.5-linux3.patch
    (see change log from Sun Aug  7 01:21:44 UTC 2011)</changelog>
  <changelog author="pgajdos@suse.com" date="1549627200">- increase timeout to fix random failure of testsuite
  + apr-test-sendfile-timeout.patch
- fix build for SLE11 again</changelog>
  <changelog author="mmanu84@outlook.de" date="1564833600">- Version 1.7.0
  * apr_dir_read: [Unix] Dropped the preference of the dirread_r() flavor
    for dirread(), because the former is both deprecated and unneeded.
    [Yann Ylavic, William Rowe]
  * apr_file_info: [Win32 only] Treat only "name surrogate" reparse points
    as symlinks, and not other reparse tag types. PR47630
    [Oleg Liatte &lt;olegliatte gmail.com&gt;]
  * Test %ld vs. %lld to avoid compiler emits using APR_OFF_T_FMT, in the
    case of apparently equivilant long and long long types. [William Rowe]
  * Recognize APPLE predefined macros as equivilant to DARWIN. [Jim Jagielski]
  * Signals: Allow handling of SIGUSR2 in apr_signal_thread. [Yann Ylavic]
  * Atomics: Support for 64bit ints. [Jim Jagielski]
  * Add the apr_encode_* API that implements RFC4648 and RFC7515
    compliant BASE64, BASE64URL, BASE32, BASE32HEX and BASE16
    encode/decode functions. [Graham Leggett]
  * rand: Use arc4random_buf() on BSD platforms and getrandom() on Linux,
    when available. [Christian Weisgerber &lt;naddy openbsd.org, Yann Ylavic]
  * Add apr_sockaddr_zone_set, apr_sockaddr_zone_set to set and retrieve
    the zone for link-local IPv6 addresses.  [Joe Orton]
  * apr_sockaddr_equal: Compare link-local IPv6 addresses with different
    zones as not equal.  [Joe Orton]
  * apr_sockaddr_ip_getbuf, apr_sockaddr_ip_get: Append "%zone" for
    IPv6 link-local addresses.  [Joe Orton]
  * Locks: add a --disable-timedlocks config option in case users
    encounter more platforms where it fails [Nick Kew].
  * apr_allocator, apr_pools: Add apr_allocator_page_size() and
    apr_allocator_min_order_set() to respectively get the (system's) page size
    in use and set the minimum allocation size for an allocator (expressed in
    2^order pages).  [Yann Ylavic]
  * locks: provide portable implementations of timedlock()s for
    posix-sems, sysv-sems and pthreads for those platforms that
    lack native versions (eg: OSX/macOS). [Jim Jagielski]
  * locks: Introduce apr_{thread,proc,global}_mutex_timedlock().
    [Yann Ylavic]
- Remove patch
  * apr-use-getrandom.patch no longer needed, apr 1.7.0 use getrandom() on Linux,
    when available.
- Refresh apr-visibility.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1630584000">- security update
- added patches
  fix CVE-2021-35940 [bsc#1190072], Regression of fix in apr 1.7
  + apr-CVE-2021-35940.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1634644800">- fix shlib-policy-name-error [bsc#1191747]</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- deleted patches
  - apr-CVE-2021-3594.patch (renamed)
- added patches
  + apr-CVE-2021-35940.patch (correct name)</changelog>
  <changelog author="coolo@suse.com" date="1648296000">- Remove autoreconf call, it breaks with uptodate autoconf versions</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1675339200">- update to 1.7.2:
  * CVE-2022-24963: Integer Overflow or Wraparound vulnerability in
    apr_encode functions allows an attacker to write beyond bounds
    of a buffer (boo#1207870)
  * Add error handling for lseek() failures in apr_file_write() and
    apr_file_writev()
  * Avoid an overflow on 32 bit platforms
  * Don't silently set APR_FOPEN_NOCLEANUP for apr_file_mktemp()
    created file to avoid a fd and inode leak when/if later passed
    to apr_file_setaside().
  * build system fixes and fixes for other platforms
- drop apr-CVE-2021-35940.patch included upstream (CVE-2021-35940)</changelog>
  <changelog author="dmueller@suse.com" date="1681646400">- update to 1.7.3:
  * apr-1-config: Fix crosscompiling detection
  * configure: Add --enable-sysv-shm to use SysV shared
    memory (shmget) if available.
  * apr_socket_sendfile: Use WSAIoctl() to get TransmitFile
    function pointer on Windows. [Ivan Zhakov]
  * apr_dir_read: Do not request short file names on Windows
    7 and later. [Ivan Zhakov]
  * apr_file_gets: Optimize for buffered files on Windows.
  * Fix a deadlock when writing to locked files opened with
    APR_FOPEN_APPEND on Windows. PR 50058. [Evgeny Kotkov]
  * Don't seek to the end when opening files with
    APR_FOPEN_APPEND on Windows.
  * apr_file_write: Optimize large writes to buffered files
    on Windows.
  * apr_file_write: Optimize large reads from buffered files
    on Windows.</changelog>
  <changelog author="pgajdos@suse.com" date="1681992000">- version update to 1.7.4
  * ) Fix a regression where writing to a file opened with both APR_FOPEN_APPEND
    and APR_FOPEN_BUFFERED did not properly append the data on Windows.
    (This regression was introduced in APR 1.7.3)  [Evgeny Kotkov]</changelog>
  <changelog author="bwiedemann@suse.com" date="1702900800">- Add reproducible.patch to drop build host name (boo#1084909)</changelog>
  <changelog author="pgajdos@suse.com" date="1726574400">- version update to 1.7.5 [bsc#1229783] CVE-2023-49582
  * ) Unix: Implement apr_shm_perms_set() for the "POSIX shm_open()"
    and "classic mmap" shared memory implementations.  [Joe Orton,
    Ruediger Pluem]
  * ) Fix missing ';' for XML/HTML hex entities from apr_escape_entity().
    [Yann Ylavic]
  * ) Fix crash in apr_pool_create() with --enable-pool-debug=all|owner.
    [Yann Ylavic]
  * ) Improve platform detection by updating config.guess and config.sub.
    [Rainer Jung]
  * ) CMake: Add support for CMAKE_WARNING_AS_ERROR. [Ivan Zhakov]
  * ) CMake: Enable support for MSVC runtime library selection by abstraction.
    [Ivan Zhakov]
  * ) CMake: Export installed targets (libapr-1, apr-1, libaprapp-1, aprapp-1)
    to apr:: namespace. [Ivan Zhakov]
- modified patches
  % apr-visibility.patch (refreshed)
  % reproducible.patch (refreshed)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1748088000">- update to 1.7.6:
  * build system fixes
  * fixes to regression tests
  * fixes for other platforms</changelog>
</package>
<package pkgid="a81315c75b62c4de6def7e12fc4a3407ac748c0be7c7a449e38b825b113cafb1" name="vlogger" arch="noarch">
  <version epoch="0" ver="1.3" rel="150600.3.1"/>
  <changelog author="boris@steki.net" date="1281009600">-Initial Package build</changelog>
  <changelog author="boris@steki.net" date="1313928000">- add requires for perl-TimeDate and added recommends
  for perl-DBD-mysql and perl-DBI as they are not required for
  basic operation of vlogger</changelog>
  <changelog author="mpluskal@suse.com" date="1500120000">- Cleanup spec file a bit</changelog>
</package>
<package pkgid="3846e7ad86ffed3595a160fdf6036606a7d70007691a5c43651430be527b80f1" name="vlogger" arch="src">
  <version epoch="0" ver="1.3" rel="150600.3.1"/>
  <changelog author="boris@steki.net" date="1281009600">-Initial Package build</changelog>
  <changelog author="boris@steki.net" date="1313928000">- add requires for perl-TimeDate and added recommends
  for perl-DBD-mysql and perl-DBI as they are not required for
  basic operation of vlogger</changelog>
  <changelog author="mpluskal@suse.com" date="1500120000">- Cleanup spec file a bit</changelog>
</package>
</otherdata>