XSS vulnerability in mod_negotiation - status in 2.2.8?

2008-02-05 Thread Boyle Owen
Greetings, Our security guy noticed this alert about a XSS vulnerability in mod_negotiation: http://www.mindedsecurity.com/MSA01150108.html. According to the link, it applies to apache = 2.2.6, so no worries for 2.2.8. However, when I double-check the changelog for 2.2.8

Re: PR42829: graceful restart with multiple listeners using prefork MPM can result in hung processes

2008-02-05 Thread Joe Orton
On Fri, Feb 01, 2008 at 10:41:39AM +0100, Stefan Fritsch wrote: Joe Orton wrote: I mentioned in the bug that the signal handler could cause undefined behaviour, but I'm not sure now whether that is true. On Linux I can reproduce some cases where this will happen, which are all due to

Re: XSS vulnerability in mod_negotiation - status in 2.2.8?

2008-02-05 Thread Joshua Slive
On Feb 5, 2008 5:40 AM, Boyle Owen [EMAIL PROTECTED] wrote: Greetings, Our security guy noticed this alert about a XSS vulnerability in mod_negotiation: http://www.mindedsecurity.com/MSA01150108.html. According to the link, it applies to apache = 2.2.6, so no worries for 2.2.8. However,

Re: XSS vulnerability in mod_negotiation - status in 2.2.8?

2008-02-05 Thread William A. Rowe, Jr.
Joshua Slive wrote: On Feb 5, 2008 5:40 AM, Boyle Owen [EMAIL PROTECTED] wrote: Greetings, Our security guy noticed this alert about a XSS vulnerability in mod_negotiation: http://www.mindedsecurity.com/MSA01150108.html. According to the link, it applies to apache = 2.2.6, so no worries for

store_headers in memcache and diskcache

2008-02-05 Thread Dirk-Willem van Gulik
Caching experts -- why do memcache and diskcache have seemingly quite different caching strategies when it comes to storing the headers ? E.g. the cache_object_t * is populated with the status/date/etc data in memcache - but not in disk-cache. Is this work in progress or subtle design ?

Re: store_headers in memcache and diskcache

2008-02-05 Thread Colm MacCarthaigh
On Tue, Feb 05, 2008 at 01:49:43PM -0500, Garrett Rooney wrote: On Feb 5, 2008 1:45 PM, Dirk-Willem van Gulik [EMAIL PROTECTED] wrote: Caching experts -- why do memcache and diskcache have seemingly quite different caching strategies when it comes to storing the headers ? E.g. the

Re: store_headers in memcache and diskcache

2008-02-05 Thread Garrett Rooney
On Feb 5, 2008 1:45 PM, Dirk-Willem van Gulik [EMAIL PROTECTED] wrote: Caching experts -- why do memcache and diskcache have seemingly quite different caching strategies when it comes to storing the headers ? E.g. the cache_object_t * is populated with the status/date/etc data in memcache -

Re: mod_proxy timeouts

2008-02-05 Thread Ronald Park
It seems like mod_proxy has gone through a lot of changes in 2.2, including changes to handling of timeouts. I brought up my initial concerns about the handling of ProxyTimeout on the [EMAIL PROTECTED] list and got absolutely no response. :( Perhaps a patch will get a little more interest there

Re: store_headers in memcache and diskcache

2008-02-05 Thread Dirk-Willem van Gulik
On Feb 5, 2008, at 7:58 PM, Colm MacCarthaigh wrote: On Tue, Feb 05, 2008 at 01:49:43PM -0500, Garrett Rooney wrote: On Feb 5, 2008 1:45 PM, Dirk-Willem van Gulik [EMAIL PROTECTED] wrote: Caching experts -- why do memcache and diskcache have seemingly quite different caching strategies

mod_proxy timeouts in the 2.0

2008-02-05 Thread Ronald Park
The problem and patch in the below message are in regards to just the Apache 2.0 line; it seems like a number of improvements in timeout handling have already been implemented in the 2.2 version of mod_proxy. However, also included in my patch is a mechanism to provide even more granularity in

Re: store_headers in memcache and diskcache

2008-02-05 Thread Ruediger Pluem
On 02/05/2008 07:45 PM, Dirk-Willem van Gulik wrote: Caching experts -- why do memcache and diskcache have seemingly quite different caching strategies when it comes to storing the headers ? E.g. the cache_object_t * is populated with the status/date/etc data in memcache - but not in

Re: PCRE pcreposix.h header missing from Apache 2.2 downloads

2008-02-05 Thread David McCreedy
On Feb 4, 2008 1:20 PM, William A. Rowe, Jr. [EMAIL PROTECTED] wrote: Arfrever Frehtes Taifersar Arahesis wrote: 2008-02-04 20:41:47 David McCreedy napisaƂ(a): It seems that the pcreposix.h header file, which pcreposix.c includes, isn't in the Apache 2.2 source tree. But I can find it