Apache HTTP Server (httpd) 2.2.15 릴리즈

아파치 소프트웨어 재단과 아파치 HTTP 서버 프로젝트에서 Apache HTTP Server ("httpd") 2.2.15 버전을 릴리즈 하였습니다.
이번 httpd 릴리즈에서는 주요한 보안과 이전 버전에서 발견된 버그를 수정하였습니다.

주목할만한 사항으로는 이번 릴리즈는 OpenSSL 프로젝트의 openssl 라이브러리 0.9.8m릴리즈와  Addressing  CVE-2009-3555 (cve.mitre.org), TLS renegotiation prefix injection attack 부분이 반영되었습니다.

이 릴리즈는 이슈인 CVE-2010-0408에서 mod_proxy_ajp, CVE-2010-0425에서 mod_isapi와  CVE-2010-0434에서의 mod_headers의 내용이 반영되어 적용되었습니다.


우리는 이번 릴리즈가 가장 좋은 httpd 버전이라고 생각하기 때문에, 사용자는 이번 버전으로 업그레이드 하시길 바랍니다.

Apache HTTP Server 2.2.15는 아래 주소에서 다운 받으실 수 있습니다.
  http://httpd.apache.org/download.cgi

 Please see the CHANGES_2.2 file, linked from the download page, for a full list of changes.  A condensed list, CHANGES_2.2.15 provides the complete list of changes since 2.2.14. A summary of security vulnerabilities which were addressed in the previous 2.2.14 and earlier releases is available:

  http://httpd.apache.org/security/vulnerabilities_22.html

Apache HTTP Server 2.2.15 is compatible with Apache Portable Runtime
(APR) versions 1.3 and 1.4, APR-util library version 1.3, and APR-iconv library version 1.2.  The most current releases should be used to address known security and platform bugs.  At the time of this httpd release, the recommended APR releases are:

  * Apache Portable Runtime (APR) library version 1.4.2 (bundled),
    or at minimum, version 1.3.12
  * ARR-util library version 1.3.9 (bundled)
  * APR-iconv library version 1.2.1 (only bundled in win32-src.zip)

Older releases of these libraries have known vulnerabilities or other defects affecting httpd.  For further information and downloads, visit:

  http://apr.apache.org/

Apache HTTP Server 2.2 offers numerous enhancements, bug fixes, and performance enhancements over the 2.0 codebase.  For an overview of new features introduced since 2.0 please see:

  http://httpd.apache.org/docs/2.2/new_features_2_2.html

This release builds upon and extends the httpd 2.0 API.  Modules written for httpd 2.0 will need to be recompiled in order to run with httpd 2.2, and may require minimal or no source code changes.

When upgrading or installing this version of httpd, please bear in mind that if you intend to use httpd with one of the threaded MPMs (other than the Prefork MPM), you must ensure that any modules you will be using (and the libraries they depend on) are thread-safe.