The Apache Software Foundation

ChangeLog

Bug

* [DIRSERVER-935] - Test hangs on non-existant schema entry lookup
* [DIRSERVER-1214] - Searches done with an empty baseDN are not accepted, except for the rootDSE
* [DIRSERVER-1314] - Helpless error message while a LDIF import fails in unit tests
* [DIRSERVER-1340] - Search the schema partition for (objectClass=metaTop) returns no results
* [DIRSERVER-1401] - Infinite loop on moddn, when moving an entry below itself
* [DIRSERVER-1404] - NullPointerException when a client disconnects
* [DIRSERVER-1459] - Adding members to a groupOfNames results in polynomial increase in JDBM partition size
* [DIRSERVER-1462] - Empty Depends field in .deb package breaks repository
* [DIRSERVER-1465] - objectClass, entryUUID, entryCSN indices not used in search optimizer
* [DIRSERVER-1470] - Error code 80 - OTHER is thrown when trying to remove a value from the objectClass attribute
* [DIRSERVER-1473] - The typesOnly flag is not correctly handled
* [DIRSERVER-1474] - IllegalStateException when restarting the LdapServer programmatically
* [DIRSERVER-1475] - The sizeLimit must be a long, not an int
* [DIRSERVER-1476] - Incorrect attribute description value set for AttributeValueAssertion in the transformFilter( ExprNode ) method of LdapTransformer
* [DIRSHARED-47] - Testfailures on jdk1.5, jdk1.6 works in shared-ldap-schema-manager

Improvement

* [DIRSERVER-1466] - Support SHA-256 for userPassword values
* [DIRSERVER-1472] - Use Generic Type Parameter for ID in XDBM instead of Long
* IRSHARED-13] - Replace the MultiHashMap in RDN by a MultiValueMap
* [DIRSHARED-15] - Create a Fast DN parser handling simple DNs
* [DIRSHARED-49] - Add i18n translation for error messages and other

Task

* [DIRSHARED-43] - Rename LdapDN to DN
* [DIRSHARED-44] - Rename Rdn to RDN
* [DIRSHARED-45] - Rename AttributeTypeAndValue to AVA

History

The Apache Server started as a fork (an independent development stream)
of the NCSA httpd, a Web server created by Rob McCool at the National Center for Supercomputing Applications.  Further development to the server ceased after McCool's departure from NCSA in 1994, so an online community of individuals was formed to support and enhance its software via email collaboration. The founding members of that community (the Apache Group) included Brian Behlendorf, Roy Fielding, Rob Hartill, David Robinson, Cliff Skolnick, Randy Terbush, Robert Thau, and Andrew Wilson.

Within less than a year of the Apache Group's formation, the Apache server surpassed NCSA httpd as the #1 server on the Internet.

In March 1999, members of the Apache Group formed The Apache Software Foundation to provide organizational, legal, and financial support for the Apache HTTP Server. An additional goal for the Foundation was to serve as a neutral, trusted platform for the development of community-driven software.

Growth, the "Apache Way"

Beyond the Apache HTTP Server, dozens of ASF projects – from build tools to Web services to cloud computing and more – lead the way in Open Source technology.

At the ASF, community plays a vital role in the collaborative development of consensus-driven, enterprise-grade solutions. The number of projects led by the Apache community has grown from the singular Apache HTTP Server at the ASF's inception in 1999 to nearly 140 projects today.

The ASF's commitment to fostering a collaborative approach to development has long served as a model for producing consistently high quality software and helping advance the future of open development. Through its leadership, robust community, and meritocratic process known as the "Apache Way", the ASF continues to gain recognition as one of the most successful influencers in Open Source.

Through the Apache Way, the ASF is able to spearhead new projects that meet the demands of the marketplace and help users achieve their business goals. With the Apache Incubator mentoring more projects than ever before, the ASF continues to meet the growing demand for quality Open Source products.

"Community Over Code": among the Foundation's core tenets is open collaboration through respectful, honest, technically-focused interaction. The ASF's success is testament to its outstanding community efforts that serve as best practices widely embraced by organizations and individuals alike.

"If it didn't happen on-list, it didn't happen": building upon the transparency-oriented culture of the Apache Group, whose collaboration took place on email lists, millions of messages are archived on Apache publicly-accessible mailing lists, documenting the ASF's achievements over the past decade.

"Meritocracy in Action": the ASF's tagline reflects an average of 10,000 code contributions (commits) made each month. The ASF is responsible for millions of lines of code by more than 2,000 ASF Committers and countless contributors across the Open Source landscape. Nearly 500 community-driven modules have been developed to extend functionality of the Apache HTTP Server alone.

Milestones

February 23, 1994: Individual patch authors around the world are invited to join the "new-httpd" mailing list to discuss enhancements and future releases of NCSA httpd. The Apache name was chosen for this new effort within the first few days of discussion, along with basic rules for email-based collaboration and a mission to replace the existing server with a standards-based, open source, and extensible software system.

March 15, 1994: Apache-style voting created (+1, 0, -1; with '-1' meaning 'no', '0' meaning 'neutral', and '+1' meaning 'yes.')

March 18, 1994: First Apache Group release (Apache 0.2)

Apache server v.1.0 was released in December 1995. Four years later, Apache HTTP Server v.1.3.0 was released, and rapidly becoming the most popular Web server on the planet.

Apache HTTP Server v.2.0 alpha was released in March 2000, with the first general availability release two years later. V.2.0 remained best-of-breed sever until the release of v.2.2.0 in December 2005, and is widely deployed across the Internet.

In February 2009, the Apache HTTP Server became the first Web server software in history to surpass the 100 million Website milestone.

The most current, best-of-breed, stable version of the Apache HTTP Server is v.2.2.14, released September 2009. Developers seeking to test new features and preview what will become stable Version 2.4 are able to do so today with the development of v.2.3.5.

Earlier this month, after ten years and more than forty revisions, the Apache HTTP Server v.1.3.x officially reached end of life status with the release of v.1.3.42. Future patches to v.1.3.x will be for critical security updates only.

The Apache HTTP Server remains the world's most beloved Web server, forming the backbone of nearly 70% of all sites on the Internet.

Availability

The Apache HTTP Server is available for a variety of operating systems, including Unix, Linux, GNU, FreeBSD, Netware, Solaris, Windows, Mac OS X, OS/2, TPF, and eCS. In addition, the Apache HTTP Server is redistributed through many proprietary software packages such as WebSphere, Oracle RDBMS, Kylix, NetWare, and Delphi, as well as numerous Linux distributions.

All ASF projects, including the Apache HTTP Server, are available free of charge under the Apache Software License v.2.0. To download, or for more information, visit http://httpd.apache.org/

About The Apache Software Foundation (ASF)

Established in 1999, the all-volunteer Foundation oversees more than seventy leading Open Source projects, including Apache HTTP Server — the world's most popular Web server software. Through The ASF's meritocratic process known as "The Apache Way," more than 300 individual Members and 2,000 Committers successfully collaborate to develop freely available enterprise-grade software, benefiting millions of users worldwide: thousands of software solutions are distributed under the Apache License; and the community actively participates in ASF mailing lists, mentoring initiatives, and ApacheCon, the Foundation's official user conference, trainings, and expo. The ASF is funded by individual donations and corporate sponsors including Facebook, Google, HP, Microsoft, Progress Software, SpringSource, and Yahoo! For more information, visit http://www.apache.org/.

  This Announcement notes the significant changes in 1.3.42 as compared to 1.3.41.

  This version of Apache is is principally a bug and security fix release.
  The following moderate security flaw has been addressed:

    * CVE-2010-0010 (cve.mitre.org)
      mod_proxy: Prevent chunk-size integer overflow on platforms
      where sizeof(int) < sizeof(long). Reported by Adam Zabrocki.

  Please see the CHANGES_1.3.42 file in this directory for a full list
  of changes for this version.

  Apache 1.3.42 is the final stable release of the Apache 1.3 family. We
  strongly recommend that users of all earlier versions, including 1.3
  family releases, upgrade to to the current 2.2 version as soon as possible.
  For information about how to upgrade, please see the documentation:

         http://httpd.apache.org/docs/2.2/upgrading.html

  Apache 1.3.42 is available for download from

          http://httpd.apache.org/download.cgi

  This service utilizes the network of mirrors listed at:

          http://www.apache.org/mirrors/

  Binary distributions may be available for your specific platform from

          http://www.apache.org/dist/httpd/binaries/

  Binaries distributed by the Apache HTTP Server Project are provided as a
  courtesy by individual project contributors. The project makes no
  commitment to release the Apache HTTP Server in binary form for any
  particular platform, nor on any particular schedule.

  IMPORTANT NOTE FOR APACHE USERS: Apache 1.3 was designed for Unix OS
  variants. While the ports to non-Unix platforms (such as Win32, Netware or
  OS2) will function for some applications, Apache 1.3 is not designed for
  these platforms. Apache 2 was designed from the ground up for security,
  stability, or performance issues across all modern operating systems.
  Users of any non-Unix ports are strongly cautioned to move to Apache 2.

  The Apache project no longer distributes non-Unix platform binaries from
  the main download pages for Apache 1.3. If absolutely necessary, a binary
  may be available at http://archive.apache.org/dist/httpd/.

Apache 1.3.42 Major changes

 Security vulnerabilities

  The main security vulnerabilities addressed in 1.3.42 are:

 *) SECURITY: CVE-2010-0010 (cve.mitre.org)
    mod_proxy: Prevent chunk-size integer overflow on platforms
    where sizeof(int) < sizeof(long). Reported by Adam Zabrocki.

 Bugfixes addressed in 1.3.42 are:

 *) Protect logresolve from mismanaged DNS records that return
    blank/null hostnames.