Adding debian version 2.4.38-3+deb10u8.debian/2.4.38-3+deb10u8

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 246 insertions, 0 deletions

diff --git a/debian/apache2.NEWS b/debian/apache2.NEWS
new file mode 100644
index 0000000..6b28c83
--- /dev/null
+++ b/debian/apache2.NEWS
@@ -0,0 +1,246 @@
+apache2 (2.4.10-2) unstable; urgency=low
+
+  The default period for which rotated log files are kept has been
+  reduced from one year to 14 days.
+
+ -- Stefan Fritsch <sf@debian.org>  Tue, 23 Sep 2014 22:25:06 +0200
+
+apache2 (2.4.1-1) unstable; urgency=low
+
+  This package introduces a new major release of the Apache HTTP server. It is
+  likely the site configuration needs changes to work with this release.
+  Notable changes which need special care are:
+
+  The module interface (ABI) has changed. If you have any locally compiled
+  modules, you have to re-compile them for apache2 2.4.
+
+  The authorization and authentication system has changed. Existing
+  configurations using deprecated Order/Allow/Deny directives need to be
+  upgraded to the new system. Please review upstream's "Authentication,
+  Authorization and Access Control Howto" [1]. There is a new module
+  "mod_access_compat", which is supposed to provide backward compatibility,
+  but it does not work well in practice.
+
+  Furthermore, MPMs are simple modules now. Thus, the MPM can be changed
+  at any time by (un-)loading a specific module. Be careful when upgrading. An
+  example of changing the MPM is given below:
+
+  a2dismod mpm_worker
+  a2enmod mpm_prefork
+
+  MPM ITK users should be advised, that ITK is not a MPM anymore. Instead, it
+  is a simple Apache module, expanding functionality of the prefork MPM. Thus,
+  users should switch to the prefork MPM and enable ITK as a module. The
+  upgrade scripts ensure this for the upgrade from Debian Wheezy.
+
+  We did change the security model for Apache in our default configuration. We
+  do not allow access to the file system outside /var/www and /usr/share.
+  If you are running virtual hosts or scripts outside these directories, you
+  need to whitelist them in your configuration to grant access through HTTP.
+  Special care must be taken if you are using a sub-directory in /srv to serve
+  your content as recommended by the File Hierarchy Standard (FHS). You must
+  allow access to your served directory explicity in the corresponding virtual
+  host, or by allowing access in apache2.conf as proposed.
+
+  Along the security model, we did also change the default Document Root, files
+  are served from. Previous releases served /var/www by default when no other
+  virtual host matched the request. Starting with this release, we changed the
+  default document root to /var/www/html, so that sensitive files from other
+  virtual hosts wich are typically put into some directory below /var/www are
+  not exposed by the default virtual host. This change further improves the out
+  of box security.
+
+  Moreover, the configuration mechanism in Debian has changed. All
+  configurations in sites-enabled and conf-enabled need a ".conf" suffix now.
+  The latter replaces the deprecated /etc/apache2/conf.d/ directory (which is
+  not supported any more) and works just like {sites,mods}-{available,enabled}
+  via the "a2enconf" tool. The upgrade tries to migrate known configuration
+  files from /etc/apache2/conf.d/ to /etc/apache2/conf-available/ - please
+  review these changes.
+
+  Note this means all existing sites are ignored until they get a ".conf"
+  suffix and are re-enabled by the use of a2ensite. The script in [3] can
+  automate that for simple cases. This change also includes Debian default
+  sites, so the default site has been renamed to 000-default to avoid naming
+  confusions. The rename of the config files to *.conf makes the special
+  handling inside apache2 to ignore *.dpkg-* backup files obsolete. This
+  special handling has been removed.
+
+  Users of mod_authn_dbm should switch to htdbm to manage their DBM user
+  databases. The pure-perl management utility "dbmmanage" was removed as it was
+  outdated and orphaned upstream.
+
+  Packagers are advised to review whether their packages comply with this
+  new version. Please see [2] for detailed documentation and instructions.
+
+  [1] http://httpd.apache.org/docs/2.4/howto/auth.html
+  [2] </usr/share/doc/apache2/PACKAGING>
+  [3] </usr/share/doc/apache2/migrate-sites.pl>
+
+ -- Arno Töll <arno@debian.org>  Fri, 23 July 2012 23:50:13 +0200
+
+apache2 (2.2.15-4) unstable; urgency=low
+
+  * Note to people using mod_proxy as forward proxy, i.e. with
+    'ProxyRequests on':
+    This release disables the configuration in mods-available/proxy.conf
+    by default. You should verify that access control for proxy access
+    still works as intended. This is especially important if you have
+    your forward proxy configuration in a different configuration file
+    than proxy.conf.
+
+ -- Stefan Fritsch <sf@debian.org>  Mon, 19 Apr 2010 22:36:57 +0200
+
+apache2 (2.2.15-1) unstable; urgency=low
+
+  * To fix a security vulnerability in the design of the SSL/TLS protocol
+    (CVE-2009-3555), the protocol had to be extended (RFC 5746). By default,
+    session renegotiation is no longer supported with old clients that do not
+    implement this extension. This breaks certain configurations with client
+    certificate authentication. If you still need to support old clients, you
+    may restore the old (insecure) behaviour by uncommenting the
+
+        SSLInsecureRenegotiation on
+
+    line in /etc/apache2/mods-available/ssl.conf
+
+  * This release adds and enables mod_reqtimeout, which limits the time
+    Apache waits for a client to send a complete request. This helps to
+    mitigate against certain denial of service attacks. In case of problems
+    with slow clients, the timeout values can be adjusted in
+    /etc/apache2/mods-available/reqtimeout.conf , or the module can be
+    disabled with "a2dismod reqtimeout".
+
+ -- Stefan Fritsch <sf@debian.org>  Sat, 28 Aug 2010 20:49:30 +0100
+
+apache2 (2.2.14-6) unstable; urgency=low
+
+  * Apache now uses the environment variables APACHE_RUN_DIR, APACHE_LOCK_DIR,
+    and APACHE_LOG_DIR in the default configuration.  If you have modified
+    /etc/apache2/envvars, make sure that these variables are set and exported.
+  * There is now some support for running multiple instances of Apache on the
+    same machine. See the documentation in /usr/share/doc/apache2.2-common for
+    details.
+
+ -- Stefan Fritsch <sf@debian.org>  Sun, 07 Feb 2010 13:56:59 +0100
+
+apache2 (2.2.13-2) unstable; urgency=high
+
+  * The new support for TLS Server Name Indication added in 2.2.12 causes
+    Apache to be stricter about certain misconfigurations involving name
+    based SSL virtual hosts. This may result in Apache refusing to start
+    with the logged error message:
+
+        Server should be SSL-aware but has no certificate configured
+        [Hint: SSLCertificateFile]
+
+    Up to 2.2.11, Apache accepted configurations where the necessary SSL
+    configuration statements were included in the first (default)
+    <Virtualhost *:443> block but not in subsequent <Virtualhost *:443>
+    blocks. Starting with 2.2.12, every VirtualHost block used with SSL must
+    contain the SSLEngine, SSLCertificateFile, and SSLCertificateKeyFile
+    directives (SSLCertificateKeyFile is optional in some cases).
+
+    When you encounter the above problem, the output of the command
+
+        egrep -ir '^[^#]*(sslcertificate|sslengine|virtualhost)' \
+            /etc/apache2/*conf* /etc/apache2/*enabled
+
+    may be useful to determine which VirtualHost sections need to be changed.
+
+    Also, formerly accidentially working constructs like
+
+        <VirtualHost *:80 *:443>
+
+    where one virtual host definition is used for both a non-ssl and a ssl
+    virtual host do not work anymore. You can achieve a similar effect with
+
+        <VirtualHost *:80>
+        Include /.../vhost.include
+        </VirtualHost>
+        <VirtualHost *:443>
+        SSLEngine on
+        SSLCertificateFile ...
+        Include /.../vhost.include
+        </VirtualHost>
+
+ -- Stefan Fritsch <sf@debian.org>  Wed, 16 Sep 2009 20:14:59 +0200
+
+apache2 (2.2.9-3) unstable; urgency=low
+
+  * The directive "NameVirtualHost *" has been changed to "NameVirtualHost
+    *:80". It has also been moved from sites-available/default to ports.conf.
+    This allows to ship a proper SSL default virtual host config in
+    sites-available/default-ssl, but it means that if you use several name
+    based virtual hosts:
+    
+    - you will have to change <VirtualHost *> to <VirtualHost *:80> in your
+      name based virtual hosts
+
+    - you need to add more NameVirtualHost directives if you use other ports
+      than 80 with name based virtual hosts. You may also have to add these
+      ports to the default virtual host in /etc/apache2/sites-available/default
+      (like this: "<VirtualHost *:80 *:81>").
+    
+    If you prefer to revert to the old setup instead (and don't need the
+    default-ssl host), just change "NameVirtualHost *:80" back to
+    "NameVirtualHost *" in ports.conf and "<VirtualHost *:80>" to
+    "<VirtualHost *>" in sites-available/default.
+
+  * For mod_disk_cache, caching is again disabled in disk_cache.conf by
+    default. It usually makes more sense to enable this on a per-virtual host
+    basis.
+
+ -- Stefan Fritsch <sf@debian.org>  Mon, 30 Jun 2008 19:47:52 +0200
+
+apache2 (2.2.8-5) unstable; urgency=low
+
+  * The suexec helper program needed for mod_suexec is now shipped in a
+    separate package, apache2-suexec, which is not installed by default.
+    You need to install this package manually if you are using mod_suexec.
+
+    There is now also the apache2-suexec-custom package, which contains a
+    customizable version of suexec which can be used with different document
+    roots than /var/www.
+
+ -- Stefan Fritsch <sf@debian.org>  Sun, 04 May 2008 20:24:00 +0200
+
+apache2 (2.2.8-1) unstable; urgency=low
+
+  * The Apache User and Group and the PidFile path are now configured in
+    /etc/apache2/envvars, to make it easier to use them in scripts
+    (like the init and logrotate scripts, and apache2ctl).
+    If you have changed these settings from their default values, you need to
+    adjust /etc/apache2/envvars.
+    This also means that starting apache2 with "apache2 -k start" is no longer
+    possible, you have to use /etc/init.d/apache2 or apache2ctl.
+
+ -- Stefan Fritsch <sf@debian.org>  Tue, 15 Jan 2008 21:41:23 +0100
+
+apache2 (2.2.4-2) unstable; urgency=low
+
+  * This version introduces some changes in the configuration layout and
+    defaults. You will probably have to adjust your configuration accordingly.
+
+    - Module specific configuration has been moved from 
+      /etc/apache2/apache2.conf to /etc/apache2/mods-available/*.conf for the
+      following modules: 
+        actions          alias              autoindex
+        info             mime               negotiation
+        setenvif         status
+
+    - AddDefaultCharset is again disabled by default. See
+      /etc/apache2/conf.d/charset
+
+    - "Listen 443" is automatically enabled in /etc/apache2/ports.conf if
+      mod_ssl is enabled.
+
+  * The NO_START functionality from /etc/default/apache2 has been removed. If
+    you don't want to start apache2 on boot, rename the S*apache2 start
+    symlinks as usual.
+
+  * To ensure that the disk cache does not grow indefinitely, htcacheclean is
+    now started when mod_disk_cache is enabled. The details can be configured
+    in /etc/default/apache2 .
+
+ -- Stefan Fritsch <sf@debian.org>  Mon, 09 Jul 2007 21:50:58 +0200