Announcing the release of Apache 2.2.34 Really Final

Started by Gregg, July 04, 2017, 08:39:36 PM

Previous topic - Next topic

Gregg

NOTE: This is not an official release. Had it time to get tagged and passed the pre-release testing/voting stage before July 1 it would have been version 2.2.34.

Built with APR 1.5.2, APR-Util 1.5.4, Expat 2.2.1, PCRE 8.40 and OpenSSL 1.0.2l, IPv6 and SNI enabled.

Apache 2.2.34 is the last of the 2.2 series. No more development or maintenance to come.

Of note this unofficial release includes 4 CVEs fixes and to quote the change log "Allow single-char field names inadvertently disallowed in 2.2.32." For the 4 CVE's see the CHANGES.TXT file under the "Fixed in 2.2.33" heading.

Because these have not been through the usual release procedures it is unknown as to how they will hold up and you mileage may vary. I would suggest you back up the 2.2.32 you are using in case you need to revert back to it if you find something no longer working as it has in the past. Consider these Release Candidates until you are sure they work properly for your specific use case.

These packages will only be available until July 20, 2017 +/- one day. That is 2 weeks, 1-3 days from now.

You can get these unofficial releases on our download page.

Because the evildoers love to find holes in software after it has gone end-of-life, it's time now to upgrade to Apache 2.4. If you don't, you may find yourself a very unhappy camper sometime in the future, or not, never know. I know for some this will probably stay on your server up until something else forces an upgrade and not before. I myself used to be this way but the times have changed and it's no longer prudent.