# changelog

author: Jan Kaluza <jkaluza@redhat.com> - 1.1-7
changelog:
  - Obsolete all versions of httpd24-apr and httpd24-apr-util on RHEL7 (#1218271)
  - Do not mention RHSCL version in README and man page (#1219112)
  - Fix bad man page syntax (#1219511)


author: Kamil Dudka <kdudka@redhat.com> 7.46.0-1
changelog:
  - disable silent builds (suggested by Paul Howarth)
  - use default port numbers when running the upstream test-suite
  - install zsh completion script
  - new upstream release


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.10-2
changelog:
  - allow enabling additional SCLs using service-environment file
  - enable mod_request by default for mod_auth_form
  - move disabled-by-default modules from 00-base.conf to 00-optional.conf


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.12-6.1
changelog:
  - core: fix chunk header parsing defect (CVE-2015-3183)
  - core: replace of ap_some_auth_required with ap_some_authn_required
    and ap_force_authn hook (CVE-2015-3185)
  - core: fix pointer dereference crash with ErrorDocument 400 pointing
    to a local URL-path (CVE-2015-0253)
  - mod_lua: fix possible mod_lua crash due to websocket bug (CVE-2015-0228)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
    by assuming the date is correct and changing the weekday.


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Ran Regex: vstring Red Hat => vstring Scientific Linux
  -->  This RPM shouldn't say it is upstream's product
  - Added Source: httpd-sl_index.html.sl.patch
  -->  This patch removes TUV branding from the default index.html
  - Added Source: httpd24-httpd.ini
  -->  Config file for automated patch script
  - Added Source: httpd-spec_sl_index.html.sl7.patch
  -->  The index.html file is outside of the source tarball, so we need to patch it in the install step


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-25
changelog:
  - Remove mod_proxy_fcgi fix for heap-based buffer overflow,
    httpd-2.4.6 is not affected (CVE-2014-3583)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.10-1
changelog:
  - update to 2.4.10
  - remove mod_proxy_html obsolete (#1174790)
  - remove dbmmanage from httpd-tools (#1151375)
  - add slash before root_libexecdir macro (#1149076)
  - ab: fix integer overflow when printing stats with lot of requests (#1091650)
  - mod_ssl: use 2048-bit RSA key with SHA-256 signature in dummy certificate (#1079925)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.18-2
changelog:
  - use HTTPD_LANG in sysconfig file on RHEL6 (#1222055)
  - ignore HTTPD sysconfig variable on RHEL6 (#1204075)
  - call restorecon on /etc/rc.d/init.d/htcacheclean after install (#1222494)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.18-5
changelog:
  - apachectl: use httpd from the SCL in apachectl (#1319780)
  - apachectl: ignore HTTPD variable also on RHEL6 (#1221681)


author: Joe Orton <jorton@redhat.com> - 2.4.18-6
changelog:
  - fix apxs generated Makefile path to build directory (#1319837)
  - use redirects for lang-specific /manual/ URLs (#1324406)


author: Joe Orton <jorton@redhat.com> - 2.4.18-7
changelog:
  - mod_lua: use anonymous shm segment (#1225116)
  - revert 'apachectl graceful' to start httpd if stopped (#1221702)


author: Joe Orton <jorton@redhat.com> - 2.4.18-10
changelog:
  - load more built modules (including mod_http2) by default (#1302653)
  - lower log-level for mod_ssl NPN debugging (#1302653)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-16
changelog:
  - don't run posttrans restart if httpd-disable-posttrans exists (#1047097)
  - mod_proxy: fix crash in brigade cleanup under high load (#1040448)
  - remove "webserver" from provides (#1042877)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-18
changelog:
  - add legacy action scripts and htcacheclean service file,
    use syslog for suexec logging (#1061009)
  - mod_dav: fix locktoken handling (#1061010)
  - mod_ssl: sanity-check use of "SSLCompression" (#1061011)
  - mod_ssl: allow SSLEngine to override Listen-based default (#1061016)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-19
changelog:
  - mod_dav: add security fix for CVE-2013-6438 (#1077885)
  - mod_log_config: add security fix for CVE-2014-0098 (#1077885)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-21
changelog:
  - mod_cgid: add security fix for CVE-2014-0231
  - mod_proxy: add security fix for CVE-2014-0117
  - mod_deflate: add security fix for CVE-2014-0118
  - mod_status: add security fix for CVE-2014-0226
  - mod_cache: add secutiry fix for CVE-2013-4352


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-23
changelog:
  - core: fix bypassing of mod_headers rules via chunked requests (CVE-2013-5704)
  - mod_cache: fix NULL pointer dereference on empty Content-Type (CVE-2014-3581)
  - mod_proxy_fcgi: fix heap-based buffer overflow (CVE-2014-3583)


