httpd-2.4.69

[Bruce Dubbs]

New point version.

[Bruce Dubbs]

Changes with Apache 2.4.69

• Fix the tar icon in the documentation so that its background is transparent.

• mod_ssl: Fix OpenSSL compatibility macros for X509_get0_notBefore, X509_get0_notAfter, and X509_get0_serialNumber with OpenSSL < 1.1.

• mod_cgid, mod_ssl, mod_md: Various hardening fixes.

• mod_md: MDServerStatus is now disabled by default.

• mod_auth_digest: Fix compatibility with expression-based AuthName.

• mod_auth_digest.c: Drop RFC 2069 support; rewrite shared memory handling and client nonce handling; "authdigest-opaque" mutex is now longer needed.

• mod_lbmethod_heartbeat: Use safe integer parsing with range validation, replacing atoi().

• core: Reject control characters in the reason phrase of interim responses. Only accept space as status-code separator.

• mod_substitute: Fix SubstituteMaxLineLength to reject values too large for the K/M/G suffix.

• mod_substitute: Fix crash or misbehaviour when loading a Substitute directive with a missing closing delimiter.

• mod_dir: Fix a crash in fixup_dir for a request not mapped to any type.

• mod_http2: Do not drop an in-flight response when a client sends a graceful GOAWAY (error code 0) while streams it opened are still being processed. The session now drains open streams instead of tearing down immediately, which async MPMs hit far more than event. Fixes a silently dropped response; RFC 9113 compliant.

• mod_md: OpenSSL 4 compatibility.

• pytest_suite: Port of the old PERL test framework to Python and pytest. Now included in the source tree under ./test

[Bruce Dubbs]

Fixed at commits

bf14fc1674 Update to kea-3.2.1.
be68469eb8 Remove obsolete portions of kea.
8e3d3b682c Update to LVM2.2.03.43.
8f92ed9c8f Update to httpd-2.4.69.