publishing release httpd-2.4.56

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1908159 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 16f8f55dd2d7e3eb37e535ae568d9d95a1edd7b5..db8f0443eaed8a2676ff5d6a52ec59a4d6afbbf5 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,39 @@
                                                          -*- coding: utf-8 -*-
+Changes with Apache 2.4.57
+
 Changes with Apache 2.4.56
 
+  *) SECURITY: CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi
+     HTTP response splitting (cve.mitre.org)
+     HTTP Response Smuggling vulnerability in Apache HTTP Server via
+     mod_proxy_uwsgi. This issue affects Apache HTTP Server: from
+     2.4.30 through 2.4.55.
+     Special characters in the origin response header can
+     truncate/split the response forwarded to the client.
+     Credits: Dimas Fariski Setyawan Putra (nyxsorcerer)
+
+  *) SECURITY: CVE-2023-25690: HTTP request splitting with
+     mod_rewrite and mod_proxy (cve.mitre.org)
+     Some mod_proxy configurations on Apache HTTP Server versions
+     2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.
+     Configurations are affected when mod_proxy is enabled along with
+     some form of RewriteRule
+     or ProxyPassMatch in which a non-specific pattern matches
+     some portion of the user-supplied request-target (URL) data and
+     is then
+     re-inserted into the proxied request-target using variable
+     substitution. For example, something like:
+     RewriteEngine on
+     RewriteRule "^/here/(.*)" "
+     http://example.com:8080/elsewhere?$1"
+     http://example.com:8080/elsewhere ; [P]
+     ProxyPassReverse /here/  http://example.com:8080/
+     http://example.com:8080/
+     Request splitting/smuggling could result in bypass of access
+     controls in the proxy server, proxying unintended URLs to
+     existing origin servers, and cache poisoning.
+     Credits: Lars Krapf of Adobe
+
   *) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
      truncated without the initial logfile being truncated.  [Eric Covener]
 

diff --git a/STATUS b/STATUS
index a19a24d31241c813fe4316d54ab46d37434a4564..c99034803732c3f377ff0ce53ff4b7c86733ed03 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -29,7 +29,8 @@ Release history:
     [NOTE that x.{odd}.z versions are strictly Alpha/Beta releases,
           while x.{even}.z versions are Stable/GA releases.]
 
-    2.4.56  : In development
+    2.4.57  : In development
+    2.4.56  : Released on March 07, 2023
     2.4.55  : Released on January 17, 2023
     2.4.54  : Released on June 08, 2022
     2.4.53  : Released on March 14, 2022

diff --git a/docs/manual/mod/mod_md.html.fr.utf8 b/docs/manual/mod/mod_md.html.fr.utf8
index 97f26f7a8ea6be0cffa30cc0fb64780015f6038a..737cfbe77ad50ed02070ff00447cecda1af63cb0 100644 (file)
--- a/docs/manual/mod/mod_md.html.fr.utf8
+++ b/docs/manual/mod/mod_md.html.fr.utf8
@@ -29,6 +29,8 @@
 <p><span>Langues Disponibles: </span><a href="../en/mod/mod_md.html" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
 <a href="../fr/mod/mod_md.html" title="Français">&nbsp;fr&nbsp;</a></p>
 </div>
+<div class="outofdate">Cette traduction peut être périmée. Vérifiez la version
+            anglaise pour les changements récents.</div>
 <table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Gestion des domaines au sein des serveurs virtuels et obtention
     de certificats via le protocole ACME
     </td></tr>

diff --git a/docs/manual/programs/rotatelogs.html.fr.utf8 b/docs/manual/programs/rotatelogs.html.fr.utf8
index e73487f958d9354c455d46ab3c1ff2e2ec28344c..c5f8ee1da93ce261e610b80fe2bdd7e151785a69 100644 (file)
--- a/docs/manual/programs/rotatelogs.html.fr.utf8
+++ b/docs/manual/programs/rotatelogs.html.fr.utf8
@@ -30,6 +30,8 @@
 <a href="../ko/programs/rotatelogs.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
 <a href="../tr/programs/rotatelogs.html" hreflang="tr" rel="alternate" title="Türkçe">&nbsp;tr&nbsp;</a></p>
 </div>
+<div class="outofdate">Cette traduction peut être périmée. Vérifiez la version
+            anglaise pour les changements récents.</div>
 
      <p><code>rotatelogs</code> est un programme simple à utiliser en
      conjonction avec la fonctionnalité d'Apache de redirection dans un

diff --git a/docs/manual/style/version.ent b/docs/manual/style/version.ent
index 29e0dfc751242f7c92d6276551a917286d63e983..30ec0ddd9c08154928cd620ded7a742d80fd6176 100644 (file)
--- a/docs/manual/style/version.ent
+++ b/docs/manual/style/version.ent
@@ -19,6 +19,6 @@
 
 <!ENTITY httpd.major "2">
 <!ENTITY httpd.minor "4">
-<!ENTITY httpd.patch "56">
+<!ENTITY httpd.patch "57">
 
 <!ENTITY httpd.docs "2.4">

diff --git a/include/ap_release.h b/include/ap_release.h
index c643dad8cc2a9bde042a9becda825e0349a68b1e..ef0a3d573325b60fa963ad5f011b91934d910f34 100644 (file)
--- a/include/ap_release.h
+++ b/include/ap_release.h
@@ -43,7 +43,7 @@
 
 #define AP_SERVER_MAJORVERSION_NUMBER 2
 #define AP_SERVER_MINORVERSION_NUMBER 4
-#define AP_SERVER_PATCHLEVEL_NUMBER   56
+#define AP_SERVER_PATCHLEVEL_NUMBER   57
 #define AP_SERVER_DEVBUILD_BOOLEAN    1
 
 /* Synchronize the above with docs/manual/style/version.ent */