New 2.4.65

.github/workflows/linux.yml

@@ -53,6 +53,10 @@ jobs:
           - name: Event MPM, all-modules, mod_cgid fdpassing
             config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi --enable-cgid-fdpassing
           # -------------------------------------------------------------------------
+          - name: Shared MPMs, all-modules, 64-bit ARM
+            config: --enable-mods-shared=reallyall --enable-mpms-shared=all
+            os: ubuntu-24.04-arm
+          # -------------------------------------------------------------------------
           - name: Event MPM, all-modules, mod_cgid w/o fdpassing
             config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi
           # -------------------------------------------------------------------------
@@ -240,7 +244,7 @@ jobs:
           #     APR_VERSION=1.7.3
           #     APU_VERSION=1.6.3
           # APU_CONFIG="--with-crypto --with-ldap"
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os == '' && 'ubuntu-latest' || matrix.os }}
     timeout-minutes: 30
     env:
       NOTEST_CFLAGS: ${{ matrix.notest-cflags }}

CHANGES

@@ -1,4 +1,191 @@
                                                          -*- coding: utf-8 -*-
+Changes with Apache 2.4.65
+
+Changes with Apache 2.4.64
+
+  *) SECURITY: CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by
+     Memory Increase (cve.mitre.org)
+     Late Release of Memory after Effective Lifetime vulnerability in
+     Apache HTTP Server.
+     This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63.
+     Users are recommended to upgrade to version 2.4.64, which fixes
+     the issue.
+     Credits: Gal Bar Nahum
+
+  *) SECURITY: CVE-2025-49812: Apache HTTP Server: mod_ssl TLS
+     upgrade attack (cve.mitre.org)
+     In some mod_ssl configurations on Apache HTTP Server versions
+     through to 2.4.63, an HTTP desynchronisation attack allows a
+     man-in-the-middle attacker to hijack an HTTP session via a TLS
+     upgrade.
+     Only configurations using "SSLEngine optional" to enable TLS
+     upgrades are affected. Users are recommended to upgrade to
+     version 2.4.64, which removes support for TLS upgrade.
+     Credits: Robert Merget (Technology Innovation Institute)
+
+  *) SECURITY: CVE-2025-49630: Apache HTTP Server: mod_proxy_http2
+     denial of service (cve.mitre.org)
+     In certain proxy configurations, a denial of service attack
+     against Apache HTTP Server versions 2.4.26 through to 2.4.63
+     can be triggered by untrusted clients causing an assertion in
+     mod_proxy_http2.
+     Configurations affected are a reverse proxy is configured for an
+     HTTP/2 backend, with ProxyPreserveHost set to "on".
+     Credits: Anthony CORSIEZ
+
+  *) SECURITY: CVE-2025-23048: Apache HTTP Server: mod_ssl access
+     control bypass with session resumption (cve.mitre.org)
+     In some mod_ssl configurations on Apache HTTP Server 2.4.35
+     through to 2.4.62, an access control bypass by trusted clients
+     is possible using TLS 1.3 session resumption.
+     Configurations are affected when mod_ssl is configured for
+     multiple virtual hosts, with each restricted to a different set
+     of trusted client certificates (for example with a different
+     SSLCACertificateFile/Path setting). In such a case, a client
+     trusted to access one virtual host may be able to access another
+     virtual host, if SSLStrictSNIVHostCheck is not enabled in either
+     virtual host.
+     Credits: Sven Hebrok, Felix Cramer, Tim Storm, Maximilian Radoy,
+     and Juraj Somorovsky at Paderborn University
+
+  *) SECURITY: CVE-2024-47252: Apache HTTP Server: mod_ssl error log
+     variable escaping (cve.mitre.org)
+     Insufficient escaping of user-supplied data in mod_ssl in Apache
+     HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS
+     client to insert escape characters into log files in some
+     configurations.
+     In a logging configuration where CustomLog is used with
+     "%{varname}x" or "%{varname}c" to log variables provided by
+     mod_ssl such as SSL_TLS_SNI, no escaping is performed by either
+     mod_log_config or mod_ssl and unsanitized data provided by the
+     client may appear in log files.
+     Credits: John Runyon
+
+  *) SECURITY: CVE-2024-43394: Apache HTTP Server: SSRF on Windows
+     due to UNC paths (cve.mitre.org)
+     Server-Side Request Forgery (SSRF) in Apache HTTP Server on
+     Windows allows to potentially leak NTLM hashes to a malicious
+     server via
+     mod_rewrite or apache expressions that pass unvalidated request
+     input.
+     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.63.
+     Note:  The Apache HTTP Server Project will be setting a higher
+     bar for accepting vulnerability reports regarding SSRF via UNC
+     paths.
+     The server offers limited protection against administrators
+     directing the server to open UNC paths.
+     Windows servers should limit the hosts they will connect over
+     via SMB based on the nature of NTLM authentication.
+     Credits: Kainan Zhang (@4xpl0r3r) from Fortinet
+
+  *) SECURITY: CVE-2024-43204: Apache HTTP Server: SSRF with
+     mod_headers setting Content-Type header (cve.mitre.org)
+     SSRF in Apache HTTP Server with mod_proxy loaded allows an
+     attacker to send outbound proxy requests to a URL controlled by
+     the attacker.  Requires an unlikely configuration where
+     mod_headers is configured to modify the Content-Type request or
+     response header with a value provided in the HTTP request.
+     Users are recommended to upgrade to version 2.4.64 which fixes
+     this issue.
+
+  *) SECURITY: CVE-2024-42516: Apache HTTP Server: HTTP response
+     splitting (cve.mitre.org)
+     HTTP response splitting in the core of Apache HTTP Server allows
+     an attacker who can manipulate the Content-Type response headers
+     of applications hosted or proxied by the server can split the
+     HTTP response.
+     This vulnerability was described as CVE-2023-38709 but the patch
+     included in Apache HTTP Server 2.4.59 did not address the issue.
+     Users are recommended to upgrade to version 2.4.64, which fixes
+     this issue.
+     Credits: xiaojunjie@安恒信息杭州市滨江区技能大师工作室
+
+  *) mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
+     size. PR 69402 [Jari Ahonen <jah@progress.com>]
+
+  *) mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
+     builds which enable it in libssl natively.  [Joe Orton]
+
+  *) mod_asis: Fix the log level of the message AH01236.
+     Github #527 [Michael Kaufmann <mail michael-kaufmann.ch>]
+
+  *) mod_session_dbd: ensure format used with SessionDBDCookieName and
+     SessionDBDCookieName2 are correct.
+     Github #503 [Thomas Meyer <thomas m3y3r.de>]
+
+  *) mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
+     inadvertently modify the Content-Type _response_ header. Applies to
+     Content-Type only and likely to only affect static file responses.
+     [Eric Covener]
+
+  *) mod_ssl: Remove warning over potential uninitialised value
+     for ssl protocol prior to protocol selection.
+     [Graham Leggett]
+
+  *) mod_proxy: Reuse ProxyRemote connections when possible, like prior
+     to 2.4.59.  [Jean-Frederic Clere, Yann Ylavic]
+
+  *) mod_systemd: Add systemd socket activation support.  [Paul Querna,
+     Jan Kaluza, Lubos Uhliarik <luhliari redhat.com>, Joe Orton]
+
+  *) mod_systemd: Log the SELinux context at startup if available and
+     enabled.  [Joe Orton]
+
+  *) mod_http2: update to version 2.0.32
+     The code setting the connection window size was set wrong,
+     preventing `H2WindowSize` to work.
+     Fixed <https://github.com/icing/mod_h2/issues/300>.
+     [Stefan Eissing, Michael Kaufmann]
+
+  *) mod_http2: update to version 2.0.30
+     - Fixed bug in handling over long response headers. When the 64 KB limit
+       of nghttp2 was exceeded, the request was not reset and the client was
+       left hanging, waiting for it. Now the stream is reset.
+     - Added new directive `H2MaxHeaderBlockLen` to set the limit on response
+       header sizes.
+     - Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
+       connection was reset.
+
+  *) mod_lua: Fix memory handling in LuaOutputFilter. PR 69590.
+     [Guillermo Grandes <guillermo.grandes gmail.com>]
+
+  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
+    as this interferes with backend selection who a node is unresponsive.
+    PR69624.
+
+  *) mod_proxy_balancer: Fix a regression that caused stickysession keys no
+     longer be recognized if they are provided as query parameter in the URL.
+     PR 69443 [Ruediger Pluem]
+
+  *) mod_md: update to version 2.5.2
+     - Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
+       with EC keys before RSA ones. Fixes #377. [Stefan Eissing]
+     - Fixed missing newlines in the status page output. [Andreas Groth]
+
+  *) mod_dav: Add API to expose DavBasePath setting.  [Joe Orton]
+
+  *) mod_md: update to version 2.5.1
+     - Added support for ACME profiles with new directives MDProfile and
+       MDProfileMandatory.
+     - When installing a custom CA file via `MDCACertificateFile`, also set the
+       libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
+       (when curl is linked with it) about missing CRL/OCSP in certificates.
+     - Fixed handling of corrupted httpd.json and added test 300_30 for it.
+       File is removed on error and written again. Fixes #369.
+     - Added explanation in log for how to proceed when md_store.json could not be
+       parsed and prevented the server start.
+     - restored fixed to #336 and #337 which got lost in a sync with Apache svn
+     - Add Issue Name/Uris to certificate information in md-status handler
+     - MDomains with static certificate files have MDRenewMode "manual", unless
+       "always" is configured.
+
+  *) core: Report invalid Options= argument when parsing AllowOverride
+     directives.
+     Github #310 [Zhou Qingyang <zhou1615 umn.edu>]
+
+  *) scoreboard/mod_http2: record durations of HTTP/2 requests.
+     PR 69579 [Pierre Brochard <pierre.brochard.1982@m4x.org>]
+
 Changes with Apache 2.4.63
 
   *) mod_dav: Update redirect-carefully example BrowserMatch config

CMakeLists.txt

@@ -21,6 +21,7 @@ CMAKE_MINIMUM_REQUIRED(VERSION 2.8)
 
 INCLUDE(CheckSymbolExists)
 INCLUDE(CheckCSourceCompiles)
+INCLUDE("build/build-modules-c.cmake")
 
 FIND_PACKAGE(LibXml2)
 FIND_PACKAGE(Lua51)
@@ -607,26 +608,20 @@ SET(install_targets)
 SET(install_bin_pdb)
 SET(install_modules) # special handling vs. other installed targets
 SET(install_modules_pdb)
-SET(builtin_module_shortnames "win32 mpm_winnt http so") # core added automatically
+SET(builtin_module_shortnames)
+LIST(APPEND builtin_module_shortnames "win32" "mpm_winnt" "http" "so") # core added automatically
 SET(extra_builtin_modules) # the ones specified with -DWITH_MODULES=
 
-IF(WITH_MODULES) # modules statically linked with the server
-  STRING(REPLACE "," ";" WITH_MODULE_LIST ${WITH_MODULES})
-  FOREACH(static_mod ${WITH_MODULE_LIST})
-    STRING(REGEX MATCH   "[^/]+\\.c"           mod_basename    ${static_mod})
-    STRING(REGEX REPLACE "^mod_(.*)\\.c" "\\1" mod_module_name ${mod_basename})     
-    SET(builtin_module_shortnames "${builtin_module_shortnames} ${mod_module_name}")
-    CONFIGURE_FILE(${static_mod} ${PROJECT_BINARY_DIR}/ COPYONLY)
-    SET(extra_builtin_modules ${extra_builtin_modules} ${PROJECT_BINARY_DIR}/${mod_basename})
-  ENDFOREACH()
-  EXECUTE_PROCESS(COMMAND cmd /c "echo ${builtin_module_shortnames}| awk -f ${CMAKE_CURRENT_SOURCE_DIR}/build/build-modules-c.awk > ${PROJECT_BINARY_DIR}/modules.c" RESULT_VARIABLE rv)
-  IF(rv)
-    MESSAGE(FATAL_ERROR "build-modules-c.awk failed (${rv})")
-  ENDIF()
-ELSE()
-  # no extra built-in modules; use the default modules.c to avoid the awk prereq
-  CONFIGURE_FILE(${CMAKE_CURRENT_SOURCE_DIR}/os/win32/modules.c ${PROJECT_BINARY_DIR}/ COPYONLY)
-ENDIF()
+STRING(REPLACE "," ";" WITH_MODULE_LIST "${WITH_MODULES}")
+FOREACH(static_mod ${WITH_MODULE_LIST})
+  STRING(REGEX MATCH   "[^/]+\\.c"           mod_basename    ${static_mod})
+  STRING(REGEX REPLACE "^mod_(.*)\\.c" "\\1" mod_module_name ${mod_basename})
+  LIST(APPEND builtin_module_shortnames "${mod_module_name}")
+  CONFIGURE_FILE(${static_mod} ${PROJECT_BINARY_DIR}/ COPYONLY)
+  SET(extra_builtin_modules ${extra_builtin_modules} ${PROJECT_BINARY_DIR}/${mod_basename})
+ENDFOREACH()
+
+generate_builtin_modules_c("${PROJECT_BINARY_DIR}/modules.c" "${builtin_module_shortnames}")
 
 # for easy reference from .dll/.so builds
 CONFIGURE_FILE(os/win32/BaseAddr.ref ${PROJECT_BINARY_DIR}/ COPYONLY)

Makefile.in

@@ -156,19 +156,19 @@ docs:
 	fi
 
 update-changes:
-	@for i in `find changes-entries -type f`; do \
+	@find changes-entries -type f | while read -r i ; do \
 	    cp CHANGES CHANGES.tmp ; \
-	    awk -v fname=$$i 'BEGIN{done = 0; active = 0} \
+	    awk -v fname="$$i" 'BEGIN{done = 0; active = 0} \
 	                    done == 0 && active == 0 && /^Changes with Apache /{ active = 1; print; next}; \
-	                    /^( *\*|Changes with Apache )/ && active == 1 && done == 0{rec=$$0; while(getline<fname){if (! ($$0 ~ /^ *$$/)){print}}printf "\n";print rec; active = 0; done = 1; next} //;' \
+	                    /^( *\*|Changes with Apache )/ && active == 1 && done == 0{rec=$$0; while((getline<fname) > 0){if (! ($$0 ~ /^ *$$/)){print}}printf "\n";print rec; active = 0; done = 1; next} //;' \
 	    CHANGES.tmp > CHANGES ; \
 	    rm CHANGES.tmp ; \
 	    if [ -n "$(SVN)" ] ; then \
-	        if ! $(SVN) rm $$i 2>/dev/null ; then \
-	            $(RM) $$i ; \
+	        if ! $(SVN) rm "$$i" 2>/dev/null ; then \
+	            $(RM) "$$i" ; \
 	        fi ; \
 	    else \
-	        $(RM) $$i ; \
+	        $(RM) "$$i" ; \
 	    fi ; \
 	done ; \
 	if [ -n "$(SVN)" ] ; then \

NOTICE

@@ -1,5 +1,5 @@
 Apache HTTP Server
-Copyright 2024 The Apache Software Foundation.
+Copyright 2025 The Apache Software Foundation.
 
 This product includes software developed at
 The Apache Software Foundation (https://www.apache.org/).

README.cmake

@@ -34,7 +34,6 @@ The following tools must be in PATH:
   cmake version 3.1.3 or later is required to work with current OpenSSL
   releases.  (OpenSSL is an optional prerequisite of httpd.)
 * Perl
-* If the WITH_MODULES feature is used: awk
 * If using a command-line compiler: compiler and linker and related tools
   (Refer to the cmake documentation for more information.)
 
@@ -100,8 +99,6 @@ How to build
 
 2. Make sure cmake and Perl are in PATH.  Additionally, some backends 
    require compile tools in PATH.  (Hint: "Visual Studio Command Prompt")
-   In the unlikely event that you use -DWITH_MODULES, described below, make
-   sure awk is in PATH.
 
 3. cmake -G "some backend, like 'NMake Makefiles'"
      -DCMAKE_INSTALL_PREFIX=d:/path/to/httpdinst

STATUS

@@ -29,7 +29,9 @@ Release history:
     [NOTE that x.{odd}.z versions are strictly Alpha/Beta releases,
           while x.{even}.z versions are Stable/GA releases.]
 
-    2.4.63  : In development
+    2.4.65  : In development
+    2.4.64  : Released on July 10, 2025
+    2.4.63  : Released on January 23, 2025
     2.4.62  : Released on July 17, 2024
     2.4.61  : Released on July 03, 2024
     2.4.60  : Released on July 01, 2024
@@ -161,21 +163,11 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]
 
-  *) CMake: Remove awk dependency when building using CMake. Before this awk was
-     required for -DWITH_MODULES option.
-     trunk patch: https://svn.apache.org/r1919413
-                  https://svn.apache.org/r1919587
-                  https://svn.apache.org/r1919602
-     2.4.x patch: svn merge -c r1919413 -c r1919587 -c r1919602 ^/httpd/httpd/trunk .
-     +1: ivan
-     +0: jorton - falls under RTC exception for "non-Unix build"
-
-  *) core: In set_override(), check the return value of set_allow_opts().
-           Github #310
-     trunk patch: https://svn.apache.org/r1917017
-                  https://svn.apache.org/r1923218
-     2.4.x patch: svn merge -c 1917017,1923218 ^/httpd/httpd/trunk .
-     +1: rjung (reduce code drift), jorton
+  *) mod_http2/mod_proxy_http2: Fix bug in log2() calculation
+     trunk patch: http://svn.apache.org/r1927235
+     2.4.x patch: svn merge -c 1927235 ^/httpd/httpd/trunk .
+     +1: icing,
+
 
 PATCHES/ISSUES THAT ARE BEING WORKED
   [ New entries should be added at the START of the list ]

build/build-modules-c.cmake

@@ -0,0 +1,27 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+function(generate_builtin_modules_c output_filename module_list)
+  list(PREPEND module_list "core")
+
+  foreach(module ${module_list})
+    string(APPEND MODULES_EXTERN "extern module ${module}_module;\n")
+    string(APPEND MODULES_PRELINK "  &${module}_module,\n")
+    string(APPEND MODULES_SYMBOLS "  {\"${module}_module\", &${module}_module},\n")
+    string(APPEND MODULES_PRELOAD "  &${module}_module,\n")
+  endforeach()
+
+  configure_file("build/modules.c.in" ${output_filename})
+endfunction()