|
|
BugTraq
[Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released Jul 28 2006 02:44PM William A. Rowe, Jr. (wrowe apache org) (1 replies) Re: [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released Aug 03 2006 09:05AM Philip M. Gollucci (pgollucci p6m7g8 com) (2 replies) Re: [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released Aug 03 2006 07:17PM Steve VanDevender (stevev hexadecimal uoregon edu) |
|
Privacy Statement |
> William A. Rowe, Jr. wrote:
>> Apache HTTP Server 2.2.3 Released
...
>> CVE-2006-3747: An off-by-one flaw exists in the Rewrite module,
>> mod_rewrite, as shipped with Apache 1.3 since 1.3.28, 2.0 since 2.0.46,
>> and 2.2 since 2.2.0.
> Is a release in the 2.0.x (2.0.59) soon to follow ?
If you continued reading a few para's down...
> Apache HTTP Server 1.3.37 and 2.0.59 legacy releases are also available
> with this security fix. See the appropriate CHANGES from the url above.
> The Apache HTTP Project developers strongly encourage all users to
> migrate to Apache 2.2, as only limited maintenance is performed on these
> legacy versions.
We don't expect to be publishing simultaneous spam for the old flavors every
time we release the main version; essentially it propagates the idea that the
1.3 / 2.0 branches are actively developed and maintained. We will likely fix
security flaws as they come up, but most of the time a single announcement
suffices. (Oh, and check out the subject line too :)
Bill
[ reply ]