Pages

[Gregg]

Announcing the release of mod_fcgid 2.3.9 for Apache 2.2 and 2.4.
Available on our download page.

Change in this version consist of:

Changes with mod_fcgid 2.3.9

  *) Revert fix for PR 53693, added in 2.3.8 but undocumented.  Fix
     issues with a minor optimization added in 2.3.8.  [Jeff Trawick]

Changes with mod_fcgid 2.3.8 (Not Released)

  *) SECURITY: CVE-2013-4365 (cve.mitre.org)
     Fix possible heap buffer overwrite.  Reported and solved by:
     [Robert Matthews <rob tigertech.com>]

  *) Correctly parse quotation and escaped spaces in FcgidWrapper and the
     AAA Authenticator/Authorizor/Access directives' command line argument,
     as currently documented.  PR 51194  [William Rowe]

  *) Honor quoted FcgidCmdOptions arguments (notably for InitialEnv
     assignments).  PR 51657  [William Rowe]

  *) Conform script response parsing with mod_cgid and ensure no response
     body is sent when ap_meets_conditions() determines that request
     conditions are met.  [Chris Darroch]

  *) Improve logging in access control hook functions.  [Chris Darroch]

  *) Avoid making internal sub-requests and processing Location headers
     when in FCGI_AUTHORIZER mode, as the auth hook functions already
     treat Location headers returned by scripts as an error since
     redirections are not meaningful in this mode.  [Chris Darroch]

[chromerep]

Does this release fix the mentioned issue?(http://www.apachelounge.com/viewtopic.php?p=25699#25699)

[mario]

Does this release fix the mentioned issue?(http://www.apachelounge.com/viewtopic.php?p=25699#25699)

Yes it does.

  *) Correctly parse quotation and escaped spaces in FcgidWrapper and the
     AAA Authenticator/Authorizor/Access directives' command line argument,
     as currently documented.  PR 51194  [William Rowe]

[mario]

Some users complained that for them the bug still exists. Well you have to escape the white spaces.

[Gregg]

Yes you have to escape white spaces, as the change clearly states. I agree it's strange, but it allows you to have the white space which is much better than what it was in prior versions.

[chromerep]

If I set vhost,should I add white space to the path setting?

[mario]

Nope ypu should add white space unless you have to!

The new version shall be able to handle white space if you escape it with \ (backslash). But not using white space in your paths in the better option.