apache2 (2.4.18-2ubuntu3.1) xenial-security; urgency=medium * SECURITY UPDATE: proxy request header vulnerability (httpoxy) - debian/patches/CVE-2016-5387.patch: don't pass through HTTP_PROXY in server/util_script.c. - CVE-2016-5387 -- Marc Deslauriers Thu, 14 Jul 2016 08:32:26 -0400 apache2 (2.4.18-2ubuntu3) xenial; urgency=medium [ Ryan Harper ] * Drop /etc/apache2/mods-available/http2.load. This was inadvertently introduced in 2.4.18-2ubuntu1. The intention is to not carry this at all, since http2 support is intentionally disabled (see LP 1531864). * d/apache2.maintscript: handle removal of http2.load conffile. [ Robie Basak ] * Re-write Ryan's changelog entry. -- Robie Basak Fri, 15 Apr 2016 18:00:57 +0000 apache2 (2.4.18-2ubuntu2) xenial; urgency=medium * Correct systemd-sysv-generator behavior by customizing some parameters (LP: #1488962) - d/apache2-systemd.conf: add a drop-in file to specify some parameters for the systemd unit (type=Forking and RemainsAfterExit=no), this allow a correct state synchronisation between systemctl status and actual state of apache2 daemon. - d/apache2.install: place the apache2-systemd.conf file in the correct location. -- Pierre-André MOREY Fri, 08 Apr 2016 11:48:00 +0200 apache2 (2.4.18-2ubuntu1) xenial; urgency=medium * Merge from Debian unstable. Remaining changes: - debian/{control, apache2.install, apache2-utils.ufw.profile, apache2.dirs}: Add ufw profiles. - debian/apache2.py, debian/apache2-bin.install: Add apport hook. - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE to configure. - debian/patches/086_svn_cross_compiles: Backport several cross fixes from upstream - d/index.html: replace Debian with Ubuntu on default page. - Don't build experimental http2 module for LTS: + debian/control: removed libnghttp2-dev Build-Depends (in universe). + debian/config-dir/mods-available/http2.load: removed. -- Timo Aaltonen Wed, 06 Apr 2016 00:18:31 +0300 apache2 (2.4.18-2) unstable; urgency=low * htcacheclean: - split starting/stopping into separate init script 'apache-htcacheclean' - move config from /etc/default/apache2 to /etc/default/apache-htcacheclean - make a2enmod/a2dismod enable/disable htcacheclean with mod_cache_disk - start htcacheclean as the apache2 run user/group * Fix a2query -M not returning output if apache2 config is broken. Fix missing quotes in apache2-maintscript-helper. Closes: #810500 * README.backtrace: Note that coredump directory needs to be owned by www-data. Closes: #806697 * Remove ssl work-arounds for MSIE. Newer versions of IE work without them and older versions are no longer supported by MS. Closes: #815852 * Give a hint about systemd in README.multiple-instances. Closes: #818904 * Don't treat mod_access_compat as essential. It's essentially broken, anyway. * Merge cross-compile tweaks for debian/rules from ubuntu. * Merge autopkgtests from Ubuntu. Many thanks to Robie Basak. Closes: #719245 * Fix duplicate-module-load test and make sure it fails if it cannot execute apache2ctl. * Bump Standards-Version (no changes necessary). -- Stefan Fritsch Mon, 28 Mar 2016 21:58:54 +0200 apache2 (2.4.18-1ubuntu1) xenial; urgency=medium * Merge from Debian unstable. Remaining changes: - debian/{control, apache2.install, apache2-utils.ufw.profile, apache2.dirs}: Add ufw profiles. - debian/apache2.py, debian/apache2-bin.install: Add apport hook. - Add dep8 tests. - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE to configure. - debian/patches/086_svn_cross_compiles: Backport several cross fixes from upstream - d/index.html: replace Debian with Ubuntu on default page. - Don't build experimental http2 module for LTS: + debian/control: removed libnghttp2-dev Build-Depends (in universe). + debian/config-dir/mods-available/http2.load: removed. -- Marc Deslauriers Thu, 21 Jan 2016 15:15:22 -0500 apache2 (2.4.18-1) unstable; urgency=medium * New upstream release: - mostly HTTP/2 improvements -- Stefan Fritsch Sat, 19 Dec 2015 09:26:14 +0100 apache2 (2.4.17-3ubuntu1) xenial; urgency=medium * Merge from Debian unstable. Remaining changes: - debian/{control, apache2.install, apache2-utils.ufw.profile, apache2.dirs}: Add ufw profiles. - debian/apache2.py, debian/apache2-bin.install: Add apport hook. - Add dep8 tests. - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE to configure. - debian/patches/086_svn_cross_compiles: Backport several cross fixes from upstream - d/index.html: replace Debian with Ubuntu on default page. - Don't build experimental http2 module for LTS: + debian/control: removed libnghttp2-dev Build-Depends (in universe). + debian/config-dir/mods-available/http2.load: removed. -- Marc Deslauriers Thu, 03 Dec 2015 10:07:35 -0500 apache2 (2.4.17-3) unstable; urgency=medium * mpm_prefork: Fix segfault if started with -X. Closes: #805737 -- Stefan Fritsch Mon, 23 Nov 2015 19:52:09 +0100 apache2 (2.4.17-2ubuntu1) xenial; urgency=medium * Merge from Debian unstable. Remaining changes: - debian/{control, apache2.install, apache2-utils.ufw.profile, apache2.dirs}: Add ufw profiles. - debian/apache2.py, debian/apache2-bin.install: Add apport hook. - Add dep8 tests. - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE to configure. - debian/patches/086_svn_cross_compiles: Backport several cross fixes from upstream - d/index.html: replace Debian with Ubuntu on default page. - Don't build experimental http2 module for LTS: + debian/control: removed libnghttp2-dev Build-Depends (in universe). + debian/config-dir/mods-available/http2.load: removed. -- Marc Deslauriers Fri, 20 Nov 2015 09:11:52 -0500 # For older changelog entries, run 'apt-get changelog apache2-bin'