apache2 (2.4.66-2ubuntu2.4) resolute-security; urgency=medium

  * SECURITY UPDATE: mod_ldap per-dir use-after-free
    - debian/patches/CVE-2026-29167.patch: Fix inheritance in per-dir context
      in modules/ldap/util_ldap.c.
    - CVE-2026-29167
  * SECURITY UPDATE: mod_proxy_ftp XSS
    - debian/patches/CVE-2026-29170.patch: Use ap_os_escape_path() with
      ap_escape_html() instead of ap_escape_uri() for href attributes in
      generated directory listing links in modules/proxy/mod_proxy_ftp.c.
    - CVE-2026-29170
  * SECURITY UPDATE: mod_proxy_html buffer overflow
    - debian/patches/CVE-2026-34355.patch: Simplify to use the ap_varbuf API
      in modules/filters/mod_proxy_html.c.
    - CVE-2026-34355
  * SECURITY UPDATE: ProxyPassReverseCookieMap buffer overflow
    - debian/patches/CVE-2026-34356.patch: fix dup path/domain in
      modules/proxy/proxy_util.c.
    - CVE-2026-34356
  * SECURITY UPDATE: mod_dav_fs protected directory access
    - debian/patches/CVE-2026-42535.patch: disallow DAV_FS_STATE_DIR in
      modules/dav/fs/repos.c.
    - CVE-2026-42535
  * SECURITY UPDATE: mod_xml2enc heap overflow
    - debian/patches/CVE-2026-42536.patch: Fix accounting in
      modules/filters/mod_xml2enc.c.
    - CVE-2026-42536
  * SECURITY UPDATE: OOB Read in 'merge_response_headers' can cause crash
    - debian/patches/CVE-2026-43951.patch: fix lang iteration in
      modules/http/http_filters.c, modules/http2/h2_c2_filter.c.
    - CVE-2026-43951
  * SECURITY UPDATE: escalation of privilege through expressions in .htaccess
    in multiple modules
    - debian/patches/CVE-2026-44119.patch: restrict per-dir file funcs
      centrally in include/ap_expr.h, modules/mappers/mod_rewrite.c,
      modules/metadata/mod_setenvif.c, modules/proxy/mod_proxy_fcgi.c,
      server/util_expr_eval.c.
    - CVE-2026-44119
  * SECURITY UPDATE: Stack Buffer Over-Read in mod_ssl OCSP 'send_request'
    - debian/patches/CVE-2026-44185.patch: Increase wbuf with the len read by
      apr_socket_send: in modules/ssl/ssl_util_ocsp.c.
    - CVE-2026-44185
  * SECURITY UPDATE: Loop in 'proxy_ftp_handler' in mod_proxy_ftp
    - debian/patches/CVE-2026-44186.patch: fix iteration in
      modules/proxy/mod_proxy_ftp.c.
    - CVE-2026-44186
  * SECURITY UPDATE: Heap Underflow in 'ap_regname' via Signed Char Overflow
    - debian/patches/CVE-2026-44631.patch: restrict to reasonable captures in
      include/ap_regex.h, modules/proxy/mod_proxy.c, server/core.c,
      server/util_pcre.c.
    - CVE-2026-44631
  * SECURITY UPDATE: mod_http2 memory corruption when file handles exhausted
    - debian/patches/CVE-2026-48913.patch: update to version 2.0.42 in
      changes-entries/h2_v2.0.40.txt, changes-entries/h2_v2.0.41.txt,
      changes-entries/h2_v2.0.42.txt, modules/http2/h2_c1_io.c,
      modules/http2/h2_c1_io.h, modules/http2/h2_config.c,
      modules/http2/h2_mplx.c, modules/http2/h2_util.c,
      modules/http2/h2_version.h.
    - debian/patches/CVE-2026-48913-2.patch: fix buffer overflow in link
      mapping in modules/http2/h2_proxy_util.c.
    - debian/patches/CVE-2026-49975.patch: removed, included in above patch.
    - CVE-2026-48913
  * Updated perl-framework tests for security changes:
    - debian/perl-framework/t/apache/expr.t
    - debian/perl-framework/t/modules/headers.t
    - https://github.com/apache/httpd-tests/commit/c45f32cd44cf15aca0253dc480fe687b2e4d76ff

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 06 Jul 2026 11:33:20 -0400

apache2 (2.4.66-2ubuntu2.2) resolute-security; urgency=medium

  * SECURITY UPDATE: HTTP/2 Bomb denial of service
    - debian/patches/CVE-2026-49975.patch: fix cookie header accounting against
      LimitRequestFields in modules/http2/h2_util.c.
    - CVE-2026-49975

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 03 Jun 2026 11:25:00 -0400

apache2 (2.4.66-2ubuntu2.1) resolute-security; urgency=medium

  * SECURITY UPDATE: http2: double free and possible RCE on early reset
    - debian/patches/CVE-2026-23918.patch: update to version 2.0.37 in
      changes-entries/h2_v2.0.37.txt, modules/http2/h2_mplx.c,
      modules/http2/h2_version.h.
    - debian/patches/CVE-2026-23918-2.patch: source sync to v2.0.38 in changes-
      entries/h2_v2.0.38.txt, modules/http2/h2_c1.c, modules/http2/h2_c2.c,
      modules/http2/h2_c2_filter.c, modules/http2/h2_mplx.c,
      modules/http2/h2_proxy_session.c, modules/http2/h2_proxy_util.c,
      modules/http2/h2_session.c, modules/http2/h2_util.h,
      modules/http2/h2_version.h, modules/http2/h2_workers.c,
      modules/http2/h2_ws.c, modules/http2/h2_ws.h, test/clients/h2ws.c,
      test/modules/http2/test_800_websockets.py.
    - debian/patches/CVE-2026-23918-3.patch: update to v2.0.39 in changes-
      entries/h2_v2.0.39.txt, modules/http2/h2_session.c,
      modules/http2/h2_version.h.
    - CVE-2026-23918
  * SECURITY UPDATE: mod_rewrite elevation of privileges via ap_expr
    - debian/patches/CVE-2026-24072.patch: use AP_EXPR_FLAG_RESTRICTED in
      htaccess in modules/mappers/mod_rewrite.c,
      modules/metadata/mod_setenvif.c, modules/proxy/mod_proxy_fcgi.c.
    - CVE-2026-24072
  * SECURITY UPDATE: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()
    - debian/patches/CVE-2026-28780.patch: fix ajp_msg_check_header check in
      modules/proxy/ajp_msg.c.
    - CVE-2026-28780
  * SECURITY UPDATE: mod_md unrestricted OCSP response
    - debian/patches/CVE-2026-29168.patch: add ocsp limits in
      modules/md/md_ocsp.c.
    - CVE-2026-29168
  * SECURITY UPDATE: mod_dav_lock indirect lock crash
    - debian/patches/CVE-2026-29169.patch: use the right dav_lock_discovery in
      modules/dav/lock/locks.c.
    - CVE-2026-29169
  * SECURITY UPDATE: mod_auth_digest timing attack
    - debian/patches/CVE-2026-33006-1.patch: use apr_crypto_equals in
      configure.in, modules/aaa/mod_auth_digest.c.
    - debian/patches/CVE-2026-33006-2.patch: add ap_*_timingsafe() constant-
      time comparison functions in configure.in, include/ap_mmn.h,
      include/httpd.h, modules/aaa/mod_auth_digest.c,
      modules/session/mod_session_crypto.c, server/util.c.
    - CVE-2026-33006
  * SECURITY UPDATE: mod_authn_socache crash
    - debian/patches/CVE-2026-33007.patch: validate URL earlier in
      modules/aaa/mod_authn_socache.c.
    - CVE-2026-33007
  * SECURITY UPDATE: HTTP response splitting forwarding malicious status line
    - debian/patches/CVE-2026-33523.patch: scan outgoing status line for
      newlines and controls in modules/http/http_filters.c.
    - CVE-2026-33523
  * SECURITY UPDATE: Off-by-one OOB reads in AJP getter functions
    - debian/patches/CVE-2026-33857.patch: fix length checks in AJP msg_get
      functions in modules/proxy/ajp_msg.c.
    - CVE-2026-33857
  * SECURITY UPDATE: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing
    Null-Termination Check (ajp_msg_get_string)
    - debian/patches/CVE-2026-34032.patch: fix ajp_msg_get_string buffer checks
      in modules/proxy/ajp_msg.c.
    - CVE-2026-34032
  * SECURITY UPDATE: mod_proxy_ajp: Heap Over-Read and memory disclosure in
    ajp_parse_data()
    - debian/patches/CVE-2026-34059.patch: fix ajp_parse_data message len check
      in modules/proxy/ajp_header.c.
    - CVE-2026-34059

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 05 May 2026 09:04:33 -0400

apache2 (2.4.66-2ubuntu2) resolute; urgency=medium

  * SECURITY REGRESSION: mod_md setting MDStapleOthers is ignored breaking
    OCSP for some domains (LP: 2142766)
    - debian/patches/CVE-2025-55753-3.patch: update mod_md to version
      2.6.7 which fixes a regression in MDStapleOthers.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 05 Mar 2026 12:18:22 -0500

apache2 (2.4.66-2ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2138379). Remaining changes:
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/source/include-binaries, d/t/check-ubuntu-branding: Replace
      Debian with Ubuntu on default homepage.
      (LP #1966004, LP #1947459)
    - d/apache2.py, d/apache2-bin.install: Add apport hook
      (LP #609177)
    - d/c/m/setenvif.conf: Add dolphin and Konqueror/5 careful redirection so
      that directories can be deleted via webdav. (LP #1927742)
    - d/debhelper/apache2-maintscript-helper: Allow execution when called from a
      postinst script through a trigger (i.e., postinst triggered).
      Thanks to Roel van Meer. (Closes: #1060450)
      (LP #2038912)
    - d/index.html, d/apache2.postrm: Fix https link to apache
      documentation.
      (LP #2045055)

 -- Hector Cao <hector.cao@canonical.com>  Wed, 14 Jan 2026 16:39:27 +0100

apache2 (2.4.66-2) unstable; urgency=medium

  * Update test framework
  * Parallelize tests when more than 3 CPUs are available

 -- Yadd <yadd@debian.org>  Fri, 05 Dec 2025 18:48:30 +0100

apache2 (2.4.66-1) unstable; urgency=medium

  [ Laurent Bigonville ]
  * Enable systemd module (Closes: #860087).
  * debian/apache2ctl: Fix the restart and greceful when using system.
    When apache is not running and restart or greceful is called, apache
    was running in the user cgroup and system was be confused
    (Closes: #927302).
    This will also avoid to leak fd to apache
    (Closes: #713967).

  [ Helmut Grohne ]
  * Fix FTCBFS: (Closes: #913094)
    + Annotate perl build dependency with :any.
    + cross.patch: Use AC_PATH_TOOL to find pkg-config.
    + Generate server/test_char.h ahead of the build

  [ Jason Perrin ]
  * Fix packaging steps undo setting of setuid bit
    (Closes: #900612)

  [ Bastien Roucariès]
  * Harden systemd services. Set ProtectSystem=full
    ProtectHome=read-only, RestrictSUIDSGID=yes.
    This may break read-write CGI script to /home and
    WebDaV or other CGI/php/lua uses.
  * Move /var/run to /run and /var/lock to /run/lock
  * Allow CAP_SYS_CHROOT for chroot
    (Closes: #1091855)
  * Remove apache2 IPC

  [ Moritz Schlarb ]
  * Support Rules-Requires-Root: no (Closes: #1105015)

  [ Yadd ]
  * New upstream version (Closes: #1121926, CVE-2025-55753, CVE-2025-58098,
    CVE-2025-59775, CVE-2025-65082, CVE-2025-66200)

 -- Yadd <yadd@debian.org>  Fri, 05 Dec 2025 06:35:34 +0100

apache2 (2.4.65-3ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2126015). Remaining changes:
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/source/include-binaries, d/t/check-ubuntu-branding: Replace
      Debian with Ubuntu on default homepage.
      (LP #1966004, LP #1947459)
    - d/apache2.py, d/apache2-bin.install: Add apport hook
      (LP #609177)
    - d/c/m/setenvif.conf: Add dolphin and Konqueror/5 careful redirection so
      that directories can be deleted via webdav. (LP #1927742)
    - d/debhelper/apache2-maintscript-helper: Allow execution when called from a
      postinst script through a trigger (i.e., postinst triggered).
      Thanks to Roel van Meer. (Closes: #1060450)
      (LP #2038912)
    - d/index.html, d/apache2.postrm: Fix https link to apache
      documentation.
      (LP #2045055)
  * Dropped changes:
    - d/p/CVE-2025-54090.patch: fix return code in
      modules/mappers/mod_rewrite.c. (CVE-2025-54090)
      [ Applied upstream in version 2.4.65 ]

 -- Renan Rodrigo <rr@ubuntu.com>  Mon, 17 Nov 2025 09:22:55 -0300

apache2 (2.4.65-3) unstable; urgency=medium

  * Change default LANG in envvars from C to C.UTF-8
    (Closes: #787584)
  * systemd service apache2 is aliased to httpd
    (Closes: #915855)
  * document a2* environment files in man page
    (Closes: #880421)
  * Failing test in its test suite
    (Closes: #1107289, LP: #2112429)
  * Restart on-abnormal instead of on-abort
    (Closes: #1106280)
  * Allow triggers to use maintscript helper to restart apache
    (LP: #2038912)

 -- Bastien Roucariès <rouca@debian.org>  Mon, 11 Aug 2025 19:07:56 +0200

apache2 (2.4.65-2) unstable; urgency=high

  * Fix SSLProtocol has a duplicate "all"
    (Closes: #1109839)
  * Warn about misconfigured load balancer following fix of
    CVE-2025-23048.

 -- Bastien Roucariès <rouca@debian.org>  Tue, 29 Jul 2025 19:52:31 +0200

apache2 (2.4.65-1) unstable; urgency=medium

  * New upstream version 2.4.65 (Closes: CVE-2025-54090)
  * Unfuzz patch

 -- Yadd <yadd@debian.org>  Wed, 23 Jul 2025 16:05:45 +0200

apache2 (2.4.64-2) UNRELEASED; urgency=medium

  * Per RFC 8996 disable by default TLS 1.0 and TLS 1.1
    (Closes: #943415)

 -- Bastien Roucariès <rouca@debian.org>  Thu, 17 Jul 2025 18:03:42 +0200

apache2 (2.4.64-1ubuntu3) questing; urgency=medium

  * Rebuild to include updated RISC-V base ISA RVA23

 -- Heinrich Schuchardt <heinrich.schuchardt@canonical.com>  Wed, 03 Sep 2025 14:58:51 +0000

apache2 (2.4.64-1ubuntu2) questing; urgency=medium

  * SECURITY UPDATE: incorrect RewriteCond expr handling
    - debian/patches/CVE-2025-54090.patch: fix return code in
      modules/mappers/mod_rewrite.c.
    - CVE-2025-54090

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 23 Jul 2025 14:22:41 -0400

apache2 (2.4.64-1ubuntu1) questing; urgency=medium

  * Merge with Debian Unstable. Remaining changes:
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/source/include-binaries, d/t/check-ubuntu-branding: Replace
      Debian with Ubuntu on default homepage (LP: 1966004, LP: 1947459).
    - d/apache2.py, d/apache2-bin.install: Add apport hook (LP: 609177).
    - d/debhelper/apache2-maintscript-helper: Allow execution when called from
      a postinst script through a trigger (i.e., postinst triggered). Thanks
      to Roel van Meer (Closes: 1060450, LP: 2038912).
    - d/index.html, d/apache2.postrm: Fix HTTPS link to Apache
      documentation (LP: 2045055).
    - d/perl-framework/t/apache/pr64339.t: Fix tests per upstream testsuite
      revisions to address changes in libxml2 changes. (LP: 2112429)

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 16 Jul 2025 17:30:33 -0400

apache2 (2.4.64-1) unstable; urgency=medium

  [ Yadd ]
  * Add libanyevent-websocket-client-perl in test-suite dependencies
  * Add build dependency to libcrypt-dev (Closes: #1107049)
  * Update d/ch
  * Drop old and useless build helper (Closes: #1108897)
  * New upstream version 2.4.64
    (Closes: CVE-2025-23048, CVE-2024-42516, CVE-2024-43204, CVE-2024-43394,
    CVE-2024-47252, CVE-2025-49630, CVE-2025-49812, CVE-2025-53020)
  * Unfuzz patches

  [ Jo ]
  * Adapted comment for SSLSessionTickets (Closes: #972695)

 -- Yadd <yadd@debian.org>  Fri, 11 Jul 2025 06:37:48 +0200

apache2 (2.4.63-1ubuntu3) questing; urgency=medium

  * d/perl-framework/t/apache/pr64339.t: Fix tests per upstream testsuite
    revisions to address changes in libxml2 changes. (LP: #2112429)

 -- Thomas Ward <teward@ubuntu.com>  Wed, 04 Jun 2025 17:23:41 -0400

apache2 (2.4.63-1ubuntu2) questing; urgency=medium

  * No-change rebuild for libxml2 soname change.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 21 May 2025 08:18:41 +0200

apache2 (2.4.63-1ubuntu1) plucky; urgency=medium

  * Merge with Debian Unstable. Remaining changes:
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/source/include-binaries, d/t/check-ubuntu-branding: Replace
      Debian with Ubuntu on default homepage (LP: #1966004, LP: #1947459).
    - d/apache2.py, d/apache2-bin.install: Add apport hook (LP: #609177).
    - d/debhelper/apache2-maintscript-helper: Allow execution when called from
      a postinst script through a trigger (i.e., postinst triggered). Thanks
      to Roel van Meer (Closes: #1060450, LP: #2038912).
    - d/index.html, d/apache2.postrm: Fix HTTPS link to Apache
      documentation (LP: #2045055).
  * Dropped changes, included upstream:
    - d/c/m/setenvif.conf, d/p/fix-dolphin-to-delete-webdav-dirs.patch: Add
      dolphin and Konqueror/5 careful redirection so that directories can be
      deleted via webdav (LP: #1927742).

 -- Simon Quigley <tsimonq2@ubuntu.com>  Wed, 19 Feb 2025 01:03:52 -0600

apache2 (2.4.63-1) unstable; urgency=medium

  * Team upload
  * New upstream version 2.4.63
  * Drop patches included in upstream
  * Back to unstable

 -- Yadd <yadd@debian.org>  Fri, 24 Jan 2025 07:51:38 +0100

apache2 (2.4.62-6) experimental; urgency=medium

  * Fix Reverse proxy via mod_rewrite broken after 2.4.62
    (Closes: #1081266)

 -- Bastien Roucariès <rouca@debian.org>  Tue, 26 Nov 2024 14:39:33 +0000

apache2 (2.4.62-5) experimental; urgency=medium

  * Fix CVE-2024-38473 regression: error parsing URL //: with space
    (Closes: #1079171)

 -- Bastien Roucariès <rouca@debian.org>  Thu, 14 Nov 2024 00:14:37 +0000

apache2 (2.4.62-4) experimental; urgency=medium

  * Fix CVE-2024-38473 regression: error parsing URL //: Invalid host/port
    SetHandler "proxy:unix:/run/sympa/wwsympa.socket|fcgi://" failed
    with AH01059: error
    (Closes: #1076554)

 -- Bastien Roucariès <rouca@debian.org>  Sat, 05 Oct 2024 18:11:40 +0000

apache2 (2.4.62-3ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2085206). Remaining changes:
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/source/include-binaries, d/t/check-ubuntu-branding: Replace
      Debian with Ubuntu on default homepage.
      (LP #1966004, LP #1947459)
    - d/apache2.py, d/apache2-bin.install: Add apport hook
      (LP #609177)
    - d/c/m/setenvif.conf, d/p/fix-dolphin-to-delete-webdav-dirs.patch: Add
      dolphin and Konqueror/5 careful redirection so that directories can be
      deleted via webdav.
      (LP #1927742)
    - d/debhelper/apache2-maintscript-helper: Allow execution when called from a
      postinst script through a trigger (i.e., postinst triggered).
      Thanks to Roel van Meer. (Closes: #1060450)
      (LP #2038912)
    - d/index.html, d/apache2.postrm: Fix https link to apache
      documentation.
      (LP #2045055)

 -- Bryce Harrington <bryce@canonical.com>  Thu, 21 Nov 2024 13:36:30 -0800

apache2 (2.4.62-3) unstable; urgency=medium

  * Fix debian/changelog

 -- Bastien Roucariès <rouca@debian.org>  Fri, 04 Oct 2024 13:35:02 +0000

apache2 (2.4.62-2) unstable; urgency=medium

  * Add myself as maintainer with yadd agreement.
  * Fix CVE-2024-38474 regression:
    Better question mark tracking to avoid UnsafeAllow3F
    (Closes: #1079172)
  * Fix CVE-2024-39884 regression:
    Trust strings from configuration in mod_proxy
    (Closes: #1079206)

 -- Bastien Roucariès <rouca@debian.org>  Sun, 29 Sep 2024 18:47:03 +0000

apache2 (2.4.62-1ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2077060). Remaining changes:
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/source/include-binaries, d/t/check-ubuntu-branding: Replace
      Debian with Ubuntu on default homepage.
      (LP #1966004, LP #1947459)
    - d/apache2.py, d/apache2-bin.install: Add apport hook
      (LP #609177)
    - d/c/m/setenvif.conf, d/p/fix-dolphin-to-delete-webdav-dirs.patch: Add
      dolphin and Konqueror/5 careful redirection so that directories can be
      deleted via webdav.
      (LP #1927742)
    - d/debhelper/apache2-maintscript-helper: Allow execution when called from a
      postinst script through a trigger (i.e., postinst triggered).
      Thanks to Roel van Meer. (Closes: #1060450)
      (LP #2038912)
    - d/index.html, d/apache2.postrm: Fix https link to apache
      documentation.
      (LP #2045055)
  * Dropped:
    - d/control, d/apache2.install, d/apache2-utils.ufw.profile,
      d/apache2.dirs: Add ufw profiles
      (LP #261198)
      [Included in Debian 2.4.60-1]
    - d/control: Upgrade lua build dependency to 5.4
      (LP #1910372)
      [Included in Debian 2.4.60-1]
  
 -- Bryce Harrington <bryce@canonical.com>  Thu, 15 Aug 2024 00:32:14 -0700

apache2 (2.4.62-1) unstable; urgency=medium

  * New upstream version 2.4.62 (Closes: CVE-2024-40725, CVE-2024-40898)

 -- Yadd <yadd@debian.org>  Thu, 18 Jul 2024 06:56:52 +0400

apache2 (2.4.61-1) unstable; urgency=medium

  * New upstream version 2.4.61 (Closes: CVE-2024-39884)

 -- Yadd <yadd@debian.org>  Wed, 03 Jul 2024 19:22:29 +0400

apache2 (2.4.60-1) unstable; urgency=medium

  [ Bastien Roucariès ]
  * Forward port CVE-2023-25690 uwsgi tests
  * Fix depends of uwsgi test
  * Use python3 uwsgi plugin
  * Encode bytes for uwsgi test

  [ Bryce Harrington ]
  * Add UFW profile integration (Closes: #1071705)

  [Chris Murray]
  * Use https instead of http in doc (LP: #2045055, Closes: #1057064)

  [ Yadd ]
  * Bump liblua from liblua5.3-dev to liblua5.4-dev (Closes: #1071701)
  * Update test framework
  * releasing package apache2 version 2.4.59-1~deb12u1
  * New upstream version (CLoses: CVE-2024-36387, CVE-2024-38472,
    CVE-2024-38473, CVE-2024-38474, CVE-2024-38475, CVE-2024-38476,
    CVE-2024-38477, CVE-2024-39573)
  * Unfuzz patches

 -- Yadd <yadd@debian.org>  Mon, 01 Jul 2024 18:04:08 +0400

apache2 (2.4.59-2ubuntu2) oracular; urgency=medium

  * d/index.html, d/apache2.postrm: Fix https link to apache documentation.
    (LP: #2045055)

 -- Bryce Harrington <bryce@canonical.com>  Mon, 10 Jun 2024 23:04:49 +0000

apache2 (2.4.59-2ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2064378). Remaining changes:
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/source/include-binaries, d/t/check-ubuntu-branding: Replace
      Debian with Ubuntu on default homepage.
      (LP #1966004, LP #1947459)
    - d/apache2.py, d/apache2-bin.install: Add apport hook
      (LP #609177)
    - d/control, d/apache2.install, d/apache2-utils.ufw.profile,
      d/apache2.dirs: Add ufw profiles
      (LP #261198)
    - d/control: Upgrade lua build dependency to 5.4
      (LP #1910372)
    - d/c/m/setenvif.conf, d/p/fix-dolphin-to-delete-webdav-dirs.patch: Add
      dolphin and Konqueror/5 careful redirection so that directories can be
      deleted via webdav.
      (LP #1927742)
    - d/debhelper/apache2-maintscript-helper: Allow execution when called from a
      postinst script through a trigger (i.e., postinst triggered).
      Thanks to Roel van Meer. (Closes: #1060450)
      (LP #2038912)
  * Dropped:
    - d/p/CVE-2023-38709.patch: header validation after
      content-* are eval'ed in modules/http/http_filters.c.
      [Included in 2.4.59]
    - HTTP Response Splitting in multiple modules
      + d/p/CVE-2024-24795.patch: let httpd handle CL/TE for
        non-http handlers in include/util_script.h,
        modules/aaa/mod_authnz_fcgi.c, modules/generators/mod_cgi.c,
        modules/generators/mod_cgid.c, modules/http/http_filters.c,
        modules/proxy/ajp_header.c, modules/proxy/mod_proxy_fcgi.c,
        modules/proxy/mod_proxy_scgi.c, modules/proxy/mod_proxy_uwsgi.c.
      [Included in 2.4.59]
    - HTTP/2 DoS by memory exhaustion on endless continuation frames
      + d/p/CVE-2024-27316.patch: bail after too many failed reads
        in modules/http2/h2_session.c, modules/http2/h2_stream.c,
        modules/http2/h2_stream.h.
      [Included in 2.4.59]

 -- Bryce Harrington <bryce@canonical.com>  Thu, 23 May 2024 13:30:30 -0700

apache2 (2.4.59-2) unstable; urgency=medium

  * Breaks against fossil due to CVE-2024-24795 follows up

 -- Bastien Roucariès <rouca@debian.org>  Mon, 29 Apr 2024 21:55:28 +0000

apache2 (2.4.59-1) unstable; urgency=medium

  [ Stefan Fritsch ]
  * Remove old transitional packages libapache2-mod-md and
    libapache2-mod-proxy-uwsgi. Closes: #1032628

  [ Yadd ]
  * mod_proxy_connect: disable AllowCONNECT by default (Closes: #1054564)
  * Refresh patches
  * New upstream version 2.4.59
    (Closes: #1068412 CVE-2024-27316 CVE-2024-24795 CVE-2023-38709)
  * Refresh patches
  * Update patches
  * Update test framework

 -- Yadd <yadd@debian.org>  Fri, 05 Apr 2024 08:08:11 +0400

apache2 (2.4.58-1ubuntu8.1) noble-security; urgency=medium

  * SECURITY UPDATE: HTTP response splitting
    - debian/patches/CVE-2023-38709.patch: header validation after
      content-* are eval'ed in modules/http/http_filters.c.
    - CVE-2023-38709
  * SECURITY UPDATE: HTTP Response Splitting in multiple modules
    - debian/patches/CVE-2024-24795.patch: let httpd handle CL/TE for
      non-http handlers in include/util_script.h,
      modules/aaa/mod_authnz_fcgi.c, modules/generators/mod_cgi.c,
      modules/generators/mod_cgid.c, modules/http/http_filters.c,
      modules/proxy/ajp_header.c, modules/proxy/mod_proxy_fcgi.c,
      modules/proxy/mod_proxy_scgi.c, modules/proxy/mod_proxy_uwsgi.c.
    - CVE-2024-24795
  * SECURITY UPDATE: HTTP/2 DoS by memory exhaustion on endless
    continuation frames
    - debian/patches/CVE-2024-27316.patch: bail after too many failed reads
      in modules/http2/h2_session.c, modules/http2/h2_stream.c,
      modules/http2/h2_stream.h.
    - CVE-2024-27316

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 18 Apr 2024 11:13:41 -0400

apache2 (2.4.58-1ubuntu8) noble; urgency=medium

  * No-change rebuild against libapr1t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 07 Apr 2024 07:02:29 +0000

apache2 (2.4.58-1ubuntu7) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 08:37:28 +0000

apache2 (2.4.58-1ubuntu6) noble; urgency=medium

  * d/debhelper/apache2-maintscript-helper: Allow execution when called from a
    postinst script through a trigger (i.e., postinst triggered).
    Thanks to Roel van Meer. (LP: #2038912) (Closes: #1060450)

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Mon, 18 Mar 2024 09:35:36 -0300

apache2 (2.4.58-1ubuntu5) noble; urgency=medium

  * No-change rebuild against libcurl4t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sat, 16 Mar 2024 06:05:04 +0000

apache2 (2.4.58-1ubuntu4) noble; urgency=medium

  * No-change rebuild against libaprutil1t64

 -- Zixing Liu <zixing.liu@canonical.com>  Sat, 09 Mar 2024 23:05:43 -0700

apache2 (2.4.58-1ubuntu3) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 17:21:46 +0000

apache2 (2.4.58-1ubuntu2) noble; urgency=medium

  * d/c/m/setenvif.conf, d/p/fix-dolphin-to-delete-webdav-dirs.patch: Add
    dolphin and Konqueror/5 careful redirection so that directories can be
    deleted via webdav.
    (LP: #1927742)

 -- Bryce Harrington <bryce@canonical.com>  Wed, 24 Jan 2024 14:00:03 -0800

apache2 (2.4.58-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2040357). Remaining changes:
  
    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
      d/source/include-binaries, d/t/check-ubuntu-branding: Replace
      Debian with Ubuntu on default homepage.
      (LP #1966004, LP #1947459)
    - d/apache2.py, d/apache2-bin.install: Add apport hook
      (LP #609177)
    - d/control, d/apache2.install, d/apache2-utils.ufw.profile,
      d/apache2.dirs: Add ufw profiles
      (LP #261198)
    - d/control: Upgrade lua build dependency to 5.4

 -- Bryce Harrington <bryce@canonical.com>  Thu, 14 Dec 2023 23:52:39 -0800

apache2 (2.4.58-1) unstable; urgency=medium

  [ Bas Couwenberg ]
  * Provide dh-sequence-apache2 (Closes: #1050870)

  [ Yadd ]
  * Drop dependency to obsolete lsb-base
  * New upstream version 2.4.58 (Closes: CVE-2023-31122, CVE-2023-43622,
    CVE-2023-45802)
  * Refresh patches

 -- Yadd <yadd@debian.org>  Thu, 19 Oct 2023 14:56:29 +0400

apache2 (2.4.57-3) unstable; urgency=medium

  * Update a2enmod to drop given/when (Closes: #1050458)
  * Restore changes not included in Bookworm (set -e in apache2ctl)

 -- Yadd <yadd@debian.org>  Tue, 29 Aug 2023 11:39:32 +0400

apache2 (2.4.57-2ubuntu3) noble; urgency=medium

  * d/icons/ubuntu-logo.png: add Ubuntu image for welcome page (LP: #1947459).
  * d/t/check-ubuntu-branding: add check for ubuntu branding.

 -- Mitchell Dzurick <mitchell.dzurick@canonical.com>  Mon, 13 Nov 2023 10:49:48 -0700

apache2 (2.4.57-2ubuntu2) mantic; urgency=medium

  * d/control: Upgrade lua build dependency to 5.4

 -- Lena Voytek <lena.voytek@canonical.com>  Fri, 21 Jul 2023 14:17:42 -0700

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog apache2-doc`.
