Difference between Apache 2.4.62 & 2.4.63

.github/workflows/linux.yml

@@ -29,7 +29,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include: 
+        include:
           # -------------------------------------------------------------------------
           - name: Empty APLOGNO() test
             env: |
@@ -67,11 +67,11 @@ jobs:
             env: |
               TEST_ARGS=-order=random
           # -------------------------------------------------------------------------
-          - name: GCC 10 maintainer-mode w/-Werror, install + VPATH
+          - name: GCC 12 maintainer-mode w/-Werror, install + VPATH
             config: --enable-mods-shared=reallyall --enable-maintainer-mode
             notest-cflags: -Werror -O2
             env: |
-              CC=gcc-10
+              CC=gcc-12
               TEST_VPATH=1
               TEST_INSTALL=1
               SKIP_TESTING=1
@@ -153,6 +153,20 @@ jobs:
               TEST_ARGS="-defines LDAP"
               TESTS="t/modules/"
           # -------------------------------------------------------------------------
+          - name: APR 1.7.x, APR-util 1.7.x, LDAP
+            config: --enable-mods-shared=reallyall
+            pkgs: ldap-utils
+            env: |
+              APR_VERSION=1.7.x
+              APU_VERSION=1.7.x
+              APU_CONFIG="--with-crypto --with-ldap"
+              TEST_MALLOC=1
+              TEST_LDAP=1
+              TEST_ARGS="-defines LDAP"
+              TESTS="t/modules/"
+              CLEAR_CACHE=1
+          # -------------------------------------------------------------------------
+          ### TODO: if: *condition_not_24x
           - name: APR trunk thread debugging
             config: --enable-mods-shared=reallyall --with-mpm=event
             env: |
@@ -210,17 +224,6 @@ jobs:
           #     TEST_MD=1
           # -------------------------------------------------------------------------
           ### TODO: if: *condition_not_24x
-          - name: MOD_TLS test suite
-            config: --enable-mods-shared=reallyall --with-mpm=event --enable-mpms-shared=event
-            pkgs: curl python3-pytest nghttp2-client python3-cryptography python3-requests python3-multipart python3-filelock python3-websockets cargo cbindgen
-            env: |
-              APR_VERSION=1.7.4
-              APU_VERSION=1.6.3
-              APU_CONFIG="--with-crypto"
-              RUSTLS_VERSION="v0.13.0"
-              NO_TEST_FRAMEWORK=1
-              TEST_INSTALL=1
-              TEST_MOD_TLS=1
           # -------------------------------------------------------------------------
           ### TODO if: *condition_not_24x
           ### TODO: Fails because :i386 packages are not being found.
@@ -244,10 +247,14 @@ jobs:
       CONFIG: ${{ matrix.config }}
     name: ${{ matrix.name }}
     steps:
+    # JOBID is used in the cache keys, created here as a hash of all
+    # properties of the environment, including the image OS version,
+    # compiler flags and any job-specific properties.
     - name: Set environment variables
       run: |
         echo "${{ matrix.env }}" >> $GITHUB_ENV
-        echo JOBID=`echo "${{ matrix.notest-cflags }} ${{ matrix.env }} ${{ matrix.config }}'"| md5sum - | sed 's/ .*//'` >> $GITHUB_ENV
+        echo JOBID=`echo "OS=$ImageOS ${{ matrix.notest-cflags }} ${{ matrix.env }} ${{ matrix.config }}" \
+           | md5sum - | sed 's/ .*//'` >> $GITHUB_ENV
     # https://github.com/actions/runner-images/issues/9491#issuecomment-1989718917
     - name: Workaround ASAN issue in Ubuntu 22.04
       run: sudo sysctl vm.mmap_rnd_bits=28
@@ -258,7 +265,7 @@ jobs:
                     cpanminus libtool-bin libapr1-dev libaprutil1-dev
                     liblua5.3-dev libbrotli-dev libcurl4-openssl-dev     
                     libnghttp2-dev libjansson-dev libpcre2-dev gdb
-                    perl-doc ${{ matrix.pkgs }}
+                    perl-doc libsasl2-dev ${{ matrix.pkgs }}
     - uses: actions/checkout@v4
     - name: Cache installed libraries
       uses: actions/cache@v4
@@ -285,5 +292,6 @@ jobs:
       if: failure()
       with:
         name: error_log-${{ env.JOBID }}
-        path: test/perl-framework/t/logs/error_log
-
+        path: |
+          **/config.log
+          test/perl-framework/t/logs/error_log

.github/workflows/windows.yml

@@ -0,0 +1,63 @@
+name: Windows
+
+on:
+  push:
+    branches: [ "*" ]
+    paths-ignore:
+      - 'docs/**'
+      - STATUS
+      - CHANGES
+      - changes-entries/*
+  pull_request:
+    branches: [ "trunk", "2.4.x" ]
+    paths-ignore:
+      - 'docs/**'
+      - STATUS
+      - CHANGES
+      - changes-entries/*
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Default
+            triplet: x64-windows
+            arch: x64
+            build-type: Debug
+            generator: "Ninja"
+
+    runs-on: windows-latest
+    timeout-minutes: 30
+    name: ${{ matrix.name }}
+    env: 
+      VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
+    steps:
+      - name: Export GitHub Actions cache environment variables
+        uses: actions/github-script@v7
+        with:
+          script: |
+              core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
+              core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
+
+      - name: Install dependencies
+        run: vcpkg install --triplet ${{ matrix.triplet }} apr[private-headers] apr-util pcre2 openssl
+
+      - uses: actions/checkout@v3
+
+      - name: Configure CMake
+        shell: cmd
+        run: |
+            call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\Tools\VsDevCmd.bat" -arch=${{ matrix.arch }}
+            cmake -B ${{github.workspace}}/build -DCMAKE_BUILD_TYPE=${{ matrix.build-type }} ^
+                -G "${{ matrix.generator }}" ^
+                -DCMAKE_TOOLCHAIN_FILE=C:/vcpkg/scripts/buildsystems/vcpkg.cmake ^
+                -DAPR_INCLUDE_DIR=C:/vcpkg/installed/${{ matrix.triplet }}/include ^
+                "-DAPR_LIBRARIES=C:/vcpkg/installed/${{ matrix.triplet }}/lib/libapr-1.lib;C:/vcpkg/installed/${{ matrix.triplet }}/lib/libaprutil-1.lib"
+
+      - name: Build
+        shell: cmd
+        run: |
+            call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\Tools\VsDevCmd.bat" -arch=${{ matrix.arch }}
+            cmake --build ${{github.workspace}}/build --config ${{ matrix.build-type }}

ABOUT_APACHE

@@ -128,7 +128,7 @@ group of volunteers who vote on changes to the distributed server), then
 you need to start by subscribing to the dev@httpd.apache.org mailing list.
 One warning though: traffic is high, 1000 to 1500 messages/month.
 To subscribe to the list, send an email to dev-subscribe@httpd.apache.org.
-We recommend reading the list for a while before trying to jump in to 
+We recommend reading the list for a while before trying to jump in to
 development.
 
    NOTE: The developer mailing list (dev@httpd.apache.org) is not

CHANGES

@@ -1,6 +1,123 @@
                                                          -*- coding: utf-8 -*-
+Changes with Apache 2.4.63
+
+  *) mod_dav: Update redirect-carefully example BrowserMatch config
+     to match more recent client versions.  PR 66148, 67039.
+     [Michal Maloszewski <michal.maloszewski canonical.com>,
+      Romain Tartière <romain blogreen.org>]
+
+  *) mod_cache_socache: Fix possible crash on error path. PR 69358.
+     [Ruediger Pluem]
+
+  *) mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
+     [StephenWall]
+
+  *) mod_md: update to version 2.4.31
+     - Improved error reporting when waiting for ACME server to verify domains
+       or finalizing the order fails, e.g. times out.
+     - Increasing the timeouts to wait for ACME server to verify domain names
+       and issue the certificate from 30 seconds to 5 minutes.
+     - Change a log level from error to debug when Stapling is enabled but a
+       certificate carries no OCSP responder URL.
+
+  *) mod_proxy_balancer: Fix the handling of the stickysession configuration
+     parameter by the balancer manager. PR 69510
+     [Yutaka Tokunou <tokunou.yutaka@fujitsu.com>]
+
+  *) Add the ldap-search option to mod_authnz_ldap, allowing authorization
+     to be based on arbitrary expressions that do not include the username.
+     Make sure that when ldap searches are too long, we explicitly log the
+     error. [Graham Leggett]
+
+  *) mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
+     in the host name or port. PR 69233. [Yann Ylavic]
+
+  *) mod_log_config: Fix merging for the "LogFormat" directive.
+     PR 65222. [Michael Kaufmann <mail michael-kaufmann.ch>]
+
+  *) mod_lua: Make r.ap_auth_type writable.  PR 62497.
+     [Michael Osipov <michaelo apache.org>]
+
+  *) mod_md: update to version 2.4.29
+     - Fixed HTTP-01 challenges to not carry a final newline, as some ACME
+       server fail to ignore it. [Michael Kaufmann (@mkauf)]
+     - Fixed missing label+newline in server-status plain text output when
+       MDStapling is enabled.
+
+  *) mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
+     without "SSLCryptoDevice" configured.  [Joe Orton]
+
+  *) mod_authnz_ldap: Fix possible memory corruption if the
+     AuthLDAPSubGroupAttribute directive is configured.  [Joe Orton]  
+
+  *) mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
+     PR 69203. [Yann Ylavic]
+
+  *) mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten [P] URLs,
+     including "unix:" ones.  PR 69235, PR 69260.  [Yann Ylavic, Ruediger Pluem]
+
+  *) mod_rewrite: Error out in case a RewriteRule in directory context uses the
+     proxy, but mod_proxy is not loaded. PR 56264.
+     [Christophe Jaillet, Michael Streeter <mstreeter1@gmail.com>]
+
+  *) http: Remove support for Request-Range header sent by Navigator 2-3 and
+     MSIE 3. [Stefan Fritsch]
+
+  *) mod_rewrite: Don't require [UNC] flag to preserve a leading //
+     added by applying the perdir prefix to the substitution.
+     [Ruediger Pluem, Eric Covener]
+
+  *) Windows: Restore the ability to "Include" configuration files on UNC
+     paths. PR 69313 [Eric Covener]
+
+  *) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
+     in <Location> (incomplete fix in 2.4.62). PR 69160. [Yann Ylavic]
+
+  *) mod_md: update to version 2.4.28
+     - When the server starts, it looks for new, staged certificates to
+       activate. If the staged set of files in 'md/staging/<domain>' is messed
+       up, this could prevent further renewals to happen. Now, when the staging
+       set is present, but could not be activated due to an error, purge the
+       whole directory. [icing]
+     - Fix certificate retrieval on ACME renewal to not require a 'Location:'
+       header returned by the ACME CA. This was the way it was done in ACME
+       before it became an IETF standard. Let's Encrypt still supports this,
+       but other CAs do not. [icing]
+     - Restore compatibility with OpenSSL < 1.1. [ylavic]
+
+  *) mod_tls: removed the experimental module. It now is availble standalone
+     from https://github.com/icing/mod_tls. The rustls provided API is not
+     stable and does not align with the httpd release cycle.
+     [Stefan Eissing]
+
+  *) mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
+     PR 69197. [Yann Ylavic, Eric Covener]
+
+  *) mod_http2: Return connection monitoring to the event MPM when blocking
+     on client updates. [Stefan Eissing, Yann Ylavic]
+
 Changes with Apache 2.4.62
 
+  *) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
+     mod_rewrite in server/vhost context on Windows (cve.mitre.org)
+     SSRF in Apache HTTP Server on Windows with mod_rewrite in
+     server/vhost context, allows to potentially leak NTML hashes to
+     a malicious server via SSRF and malicious requests.
+     Users are recommended to upgrade to version 2.4.62 which fixes
+     this issue.
+     Credits: Smi1e (DBAPPSecurity Ltd.)
+
+  *) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
+     disclosure with handlers configured via AddType (cve.mitre.org)
+     A partial fix for CVE-2024-39884 in the core of Apache HTTP
+     Server 2.4.61 ignores some use of the legacy content-type based
+     configuration of handlers. "AddType" and similar configuration,
+     under some circumstances where files are requested indirectly,
+     result in source code disclosure of local content. For example,
+     PHP scripts may be served instead of interpreted.
+     Users are recommended to upgrade to version 2.4.62, which fixes
+     this issue.
+
   *) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
      "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
      with BalancerMember(s).  PR 69168.  [Yann Ylavic]
@@ -119,7 +236,7 @@ Changes with Apache 2.4.60
      Credits: Marc Stern (<marc.stern AT approach-cyber.com>)
 
   *) mod_proxy: Fix DNS requests and connections closed before the
-     configured addressTTL.  BZ 69126.  [Yann Ylavic]
+     configured addressTTL.  PR 69126.  [Yann Ylavic]
 
   *) core: On Linux, log the real thread ID in error logs.  [Joe Orton]
 
@@ -1325,7 +1442,7 @@ Changes with Apache 2.4.48
      [Yann Ylavic]
 
   *) mod_proxy: Fix flushing of THRESHOLD_MIN_WRITE data while tunneling.
-     BZ 65294.  [Yann Ylavic]
+     PR 65294.  [Yann Ylavic]
 
   *) core: Fix a regression that stripped the ETag header from 304 responses.
      PR 61820 [Ruediger Pluem, Roy T. Fielding]

CMakeLists.txt

@@ -27,6 +27,7 @@ FIND_PACKAGE(Lua51)
 FIND_PACKAGE(OpenSSL)
 FIND_PACKAGE(ZLIB)
 FIND_PACKAGE(CURL)
+FIND_PACKAGE(PCRE2 COMPONENTS 8BIT)
 
 # Options for support libraries not supported by cmake-bundled FindFOO
 
@@ -47,7 +48,10 @@ ENDIF()
 # PCRE names its libraries differently for debug vs. release builds.
 # We can't query our own CMAKE_BUILD_TYPE at configure time.
 # If the debug version exists in PREFIX/lib, default to that one.
-IF(EXISTS "${CMAKE_INSTALL_PREFIX}/lib/pcre2-8d.lib")
+IF(PCRE2_FOUND)
+  SET(default_pcre_libraries "PCRE2::8BIT")
+  SET(default_pcre_cflags "-DHAVE_PCRE2")
+ELSEIF(EXISTS "${CMAKE_INSTALL_PREFIX}/lib/pcre2-8d.lib")
   SET(default_pcre_libraries ${CMAKE_INSTALL_PREFIX}/lib/pcre2-8d.lib)
   SET(default_pcre_cflags "-DHAVE_PCRE2")
 ELSEIF(EXISTS "${CMAKE_INSTALL_PREFIX}/lib/pcre2-8.lib")
@@ -628,11 +632,10 @@ ENDIF()
 CONFIGURE_FILE(os/win32/BaseAddr.ref ${PROJECT_BINARY_DIR}/ COPYONLY)
 
 ADD_EXECUTABLE(gen_test_char server/gen_test_char.c)
-GET_TARGET_PROPERTY(GEN_TEST_CHAR_EXE gen_test_char LOCATION)
 ADD_CUSTOM_COMMAND(
   COMMENT "Generating character tables, test_char.h, for current locale"
   DEPENDS gen_test_char
-  COMMAND ${GEN_TEST_CHAR_EXE} > ${PROJECT_BINARY_DIR}/test_char.h
+  COMMAND $<TARGET_FILE:gen_test_char> > ${PROJECT_BINARY_DIR}/test_char.h
   OUTPUT ${PROJECT_BINARY_DIR}/test_char.h
 )
 ADD_CUSTOM_TARGET(

NOTICE

@@ -1,5 +1,5 @@
 Apache HTTP Server
-Copyright 2024 The Apache Software Foundation.
+Copyright 2025 The Apache Software Foundation.
 
 This product includes software developed at
 The Apache Software Foundation (https://www.apache.org/).