Apache HTTP Server 2.0.47 released [LWN.net]

Today the Apache Software Foundation and the Apache HTTP Server Project have announced the release of the Apache HTTP Server 2.0.47. This release fixes four security vulnerabilities:

Certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one could result in the weak ciphersuite being used in place of the strong one. [CAN-2003-0192]
Certain errors returned by accept() on rarely accessed ports could cause temporal denial of service, due to a bug in the prefork MPM. [CAN-2003-0253]
Denial of service was caused when target host is IPv6 but ftp proxy server can't create IPv6 socket. [CAN-2003-0254]
The server would crash when going into an infinite loop due to too many subsequent internal redirects and nested subrequests. [VU#379828]

The release is available for download now. We'll pass along vendor updates as we see them.

(Log in to post comments)

Apache HTTP Server 2.0.47 released

Posted Jul 10, 2003 12:05 UTC (Thu) by thommay (subscriber, #5425) [Link]

Debian won't be releasing a security announcement for this since Apache2 is only available in unstable and testing, but I'm aiming for a release to unstable tomorrow morning (GMT) and barring problems that code will go into testing two days afterwards.