publishing release httpd-2.4.51

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1893998 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 093d46f99a6beb82ae21c861535e4bc9b14476ed..86dfa3b8c0e9b49e29c137629545b4a68eda3c05 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,24 @@
                                                          -*- coding: utf-8 -*-
+Changes with Apache 2.4.52
+
 Changes with Apache 2.4.51
 
+  *) SECURITY: CVE-2021-42013: Path Traversal and Remote Code
+     Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete
+     fix of CVE-2021-41773) (cve.mitre.org)
+     It was found that the fix for CVE-2021-41773 in Apache HTTP
+     Server 2.4.50 was insufficient.  An attacker could use a path
+     traversal attack to map URLs to files outside the directories
+     configured by Alias-like directives.
+     If files outside of these directories are not protected by the
+     usual default configuration "require all denied", these requests
+     can succeed. If CGI scripts are also enabled for these aliased
+     pathes, this could allow for remote code execution.
+     This issue only affects Apache 2.4.49 and Apache 2.4.50 and not
+     earlier versions.
+     Credits: Reported by Juan Escobar from Dreamlab Technologies,
+     Fernando Muñoz from NULL Life CTF Team, and Shungo Kumasaka
+
   *) core: Add ap_unescape_url_ex() for better decoding control, and deprecate
      unused AP_NORMALIZE_DROP_PARAMETERS flag.
      [Yann Ylavic, Ruediger Pluem, Stefan Eissing, Joe Orton]

diff --git a/STATUS b/STATUS
index b8a055c5704c76ef6d28149b0fce61a7198cefc4..5b2a19f7821603ecfed701c574a0a2ca12c6212d 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -29,7 +29,8 @@ Release history:
     [NOTE that x.{odd}.z versions are strictly Alpha/Beta releases,
           while x.{even}.z versions are Stable/GA releases.]
 
-    2.4.51  : In development
+    2.4.52  : In development
+    2.4.51  : Released on October 07, 2021
     2.4.50  : Released on October 04, 2021
     2.4.49  : Released on September 16, 2021
     2.4.48  : Tagged on May 17, 2021. Released on June 01, 2021.

diff --git a/docs/manual/style/version.ent b/docs/manual/style/version.ent
index cd7eb4f4e3bf6e7691a288a2828af664d8654d78..e1da5bcca9e6c3865a58991f1427697e0507fd1a 100644 (file)
--- a/docs/manual/style/version.ent
+++ b/docs/manual/style/version.ent
@@ -19,6 +19,6 @@
 
 <!ENTITY httpd.major "2">
 <!ENTITY httpd.minor "4">
-<!ENTITY httpd.patch "50">
+<!ENTITY httpd.patch "52">
 
 <!ENTITY httpd.docs "2.4">

diff --git a/include/ap_release.h b/include/ap_release.h
index e9eb58ecd9843c3761de960ca746c2c84b196449..0fd8a88a11038b96b757f4e9b66b83ea292b2895 100644 (file)
--- a/include/ap_release.h
+++ b/include/ap_release.h
@@ -43,7 +43,7 @@
 
 #define AP_SERVER_MAJORVERSION_NUMBER 2
 #define AP_SERVER_MINORVERSION_NUMBER 4
-#define AP_SERVER_PATCHLEVEL_NUMBER   51
+#define AP_SERVER_PATCHLEVEL_NUMBER   52
 #define AP_SERVER_DEVBUILD_BOOLEAN    1
 
 /* Synchronize the above with docs/manual/style/version.ent */