Apache HTTP Server 2.2.22 Released [Case 56985]

[DjiXas]

* SECURITY: CVE-2011-3368 (cve.mitre.org)
Reject requests where the request-URI does not match the HTTP
specification, preventing unexpected expansion of target URLs in
some reverse proxy configurations.

* SECURITY: CVE-2011-3607 (cve.mitre.org)
Fix integer overflow in ap_pregsub() which, when the mod_setenvif module
is enabled, could allow local users to gain privileges via a .htaccess
file.

* SECURITY: CVE-2011-4317 (cve.mitre.org)
Resolve additional cases of URL rewriting with ProxyPassMatch or
RewriteRule, where particular request-URIs could result in undesired
backend network exposure in some configurations.

* SECURITY: CVE-2012-0021 (cve.mitre.org)
mod_log_config: Fix segfault (crash) when the '%{cookiename}C' log format
string is in use and a client sends a nameless, valueless cookie, causing
a denial of service. The issue existed since version 2.2.17.

* SECURITY: CVE-2012-0031 (cve.mitre.org)
Fix scoreboard issue which could allow an unprivileged child process
could cause the parent to crash at shutdown rather than terminate
cleanly.

* SECURITY: CVE-2012-0053 (cve.mitre.org)
Fixed an issue in error responses that could expose "httpOnly" cookies
when no custom ErrorDocument is specified for status code 400.

Apache HTTP Server 2.2.22 Released | Apache | Dev

[cPanelDavidG]

Given the security implications, this already has been assigned the highest level of priority so we should be seeing this in EasyApache in the coming days.

[cpanelkenneth]

This will be part of EasyApache 3.9, which is the next release.

[LDHosting]

Any word on when this might be coming? I notice that PHP 5.3.10 was added to EA today, but still no sign of Apache 2.2.22.

[cPanelDavidG]

Any word on when this might be coming? I notice that PHP 5.3.10 was added to EA today, but still no sign of Apache 2.2.22.

Working on it... thinking a scale of days rather than hours though.

[cPanelDavidG]

Apache 2.2.22 is now available in EasyApache 3.9.1 which is on all update tiers at the moment. I am closing and archiving this thread.