Mailing List Archive

[ANNOUNCE] libapreq2-2.15 Released
libapreq2-2.15 Released

The Apache Software Foundation and The Apache HTTP Server Project
are pleased to announce the 2.15 release of libapreq2. This
Announcement notes significant changes introduced by this release.

libapreq2-2.15 is released under the Apache License
version 2.0. It is now available through the ASF mirrors

https://httpd.apache.org/apreq/download.cgi


libapreq2 is an APR-based shared library used for parsing HTTP cookies,
query-strings and POST data. This package provides

1) version 2.8.1 of the libapreq2 library,

2) mod_apreq2, a filter module necessary for using libapreq2
within the Apache HTTP Server,

3) the Apache2::Request, Apache2::Cookie, and Apache2::Upload
perl modules for using libapreq2 with mod_perl2.

========================================================================

Changes with libapreq2-2.15 (released November 12, 2020)

- SECURITY: CVE-2019-12412 (cve.mitre.org)
C API [Max Kellermann]
Fix a NULL pointer dereference when parsing malformed
multipart data in apreq_parse_multipart().

- C API [Yann Ylavic]
In apreq_brigade_concat(), fix memory handling and create
the FILE bucket correctly.

- Build [Petr Pisar]
Fix "make release" on Unix.
Re: [ANNOUNCE] libapreq2-2.15 Released [ In reply to ]
Thanks, Joe, for your efforts with this release!

Should there be a v2_15 tag in http://svn.apache.org/viewvc/httpd/apreq/tags/ ?

FWIW, I successfully compiled and tested it with Apache httpd 2.4.41 and mod_perl 2.0.11 on CentOS 6.10.

My httpd and mod_perl are 32-bit/i686 for silly legacy reasons I won't get into. Previous build systems detected this and added "-m32" automatically where appropriate, but, when building libapreq2-2.15, I had to explicitly specify CFLAGS=-m32 to get it to build and test properly. No big deal. I realize compiling for 32-bits on a 64-bit system is very much an edge case, and the workaround is simple enough.

I was wondering about the following test results:

t/cgi.t .......... skipped: cannot find one of cgi.c or cgid.c
and
t/apreq/cgi.t ........ skipped: cannot find one of cgi.c or cgid.c

I went back and checked my build of libapreq2-2.13 and it does the same thing, so I guess that's fine?

Can anyone explain why the cgi.c isn't included though? Thanks!

Regards,
Ed