Download Apache 2.0.47

The people behind the most famous and widely used web server Apache today have version 2.0.47 released† This follows the 2.0.46 release that came out in May and contains some security and bug fixes. The changelog shows the following list with changes behind:

Changes with Apache 2.0.47

• SECURITY [CAN-2003-0192]: Fixed a bug whereby certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one could result in the weak ciphersuite being used in place of the strong one.
• SECURITY [CAN-2003-0253]: Fixed a bug in prefork MPM causing temporary denial of service when accept() on a rarely accessed port returns certain errors.
• SECURITY [CAN-2003-0254]: Fixed a bug in ftp proxy causing denial of service when target host is IPv6 but proxy server can’t create IPv6 socket. Fixed by the reporter. [
• SECURITY [VU#379828] Prevent the server from crashing when entering infinite loops. The new LimitInternalRecursion directive configures limits of subsequent internal redirects and nested subrequests, after which the request will be aborted. PR 19753 (and probably others).
• core_output_filter: don’t split the brigade after a FLUSH bucket if it’s the last bucket. This prevents creating unneccessary empty brigades which may not be destroyed until the end of a keepalive connection.
• Add support for “streamy” PROPFIND responses.
• mod_cgid: Eliminate a double-close of a socket. This resolves various operational problems in a threaded MPM, since on the second attempt to close the socket, the same descriptor was often already in use by another thread for another purpose.
• mod_negotiation: Introduce “prefer-language” environment variable, which allows to influence the negotiation process on request basis to prefer a certain language.
• Make mod_expires’ ExpiresByType work properly, including for dynamically-generated documents.