<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="28"><package pkgid="758a25dc6e04267841eaae4e313ae2547ec54886cd07f9e0608e3f575ee06906" name="apache2" arch="i586">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>
<package pkgid="660454f14c30e01210c093e94b586bc50be8ce8d831d75f4141c6da57ae57939" name="apache2" arch="src">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>
<package pkgid="dbd4981421fdf94ae223bfc2073606b3394ec0698f3e0d257142092eb8ecc215" name="apache2-debuginfo" arch="i586">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>
<package pkgid="4bab766e42db2501b1bff07780fc44631dc8eb6b090a688c27686769d7aaf5ed" name="apache2-debugsource" arch="i586">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>
<package pkgid="afc705adce92910905b5ee26fb4723ca18baf06345ae04d4bf80fc9a5780067d" name="apache2-devel" arch="i586">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>
<package pkgid="5b11013078109955cb207841768acff6c0c895f8f7244662852f21e733d0fe73" name="apache2-doc" arch="noarch">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>
<package pkgid="e39e6d6c44110a01240ca4abdfa6502c0245d86628293108360f9d27982730d7" name="apache2-event" arch="i586">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>
<package pkgid="11728f36d07eb0a711526775c04f00fbad39e14b28815a213cdaf2a759dcf595" name="apache2-event-debuginfo" arch="i586">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>
<package pkgid="e07bd3615998529c376c748d983b746e18e5af7e9706682db8e24bf629fe14a3" name="apache2-example-pages" arch="i586">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>
<package pkgid="35ae0819befd85943ecaa58a1e70c7254b79ae925af288cb24e6a84eb6f30956" name="apache2-prefork" arch="i586">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>
<package pkgid="042408d3dab1926594e73946e6acb9d952dbaef6f4a96fdc20e7cff609edd7ba" name="apache2-prefork-debuginfo" arch="i586">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>
<package pkgid="2e87c3bcbb93c615300b3673cced2f947b8a5e6a10eeb4bb155764df3b7ce248" name="apache2-utils" arch="i586">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>
<package pkgid="b8e92ed0337f889df7b608252d4adee634eb87a44d5ab5e40029bc6dc62aec20" name="apache2-utils-debuginfo" arch="i586">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>
<package pkgid="4907428499295619e9bf51f06064875a53d48a39add8575b0734267437eabaec" name="apache2-worker" arch="i586">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>
<package pkgid="9ba163b1e65891860c6d3134b1e7caba7b3b15d29875cb3142076aee189b8275" name="apache2-worker-debuginfo" arch="i586">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>

<package pkgid="4a06288dead3de9316f249a7122c868112c9f6ceaa600bd67681f267857cef70" name="apache2" arch="x86_64">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>

<package pkgid="30173d123a45744f32447f1b5dbd24f5be58ae314f190c9375d2399768fd5782" name="apache2-debuginfo" arch="x86_64">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>

<package pkgid="732a627d969c8f28c10845119f54491ed8cc0701587ab9f2c9d59989a1e1dfbe" name="apache2-debugsource" arch="x86_64">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>

<package pkgid="b93ccace60b75d685466b13c9ffb23dcd37d5d35cfa2dac0254147fb97be9420" name="apache2-devel" arch="x86_64">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>

<package pkgid="0f518fa511040b68644b5d6a9bb773457ab43c24a386e7c47c604e0e3f83cf79" name="apache2-event" arch="x86_64">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>

<package pkgid="d1edbf4b6477487acaa41639c2ed449a210ac80bd79dabd4667075330b313cab" name="apache2-event-debuginfo" arch="x86_64">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>

<package pkgid="495d29ca91b2972f1cf476eadad4d379f0b3b685cb8b30387cbe584c7aeeada7" name="apache2-example-pages" arch="x86_64">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>

<package pkgid="02b607f8985f4f1cc71ba249fb57b666b0cc61de08dbbc4f283021e9b949d0db" name="apache2-prefork" arch="x86_64">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>

<package pkgid="faed90444feab454cfd37f9d84cfea6937f04394785602a2a4e575d8b4f896fd" name="apache2-prefork-debuginfo" arch="x86_64">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>

<package pkgid="793f300ffdbba207b96a2a3fcf170b60f63b1624d8d85437aa5d1d3102db9d0d" name="apache2-utils" arch="x86_64">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>

<package pkgid="106bf592a336e370feed6f300421266a432b922fee870026d28b62bc022aee27" name="apache2-utils-debuginfo" arch="x86_64">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>

<package pkgid="1113377dcf859446ec77c8bd238d3f56266d807172d25dec3f869b4d5e44d5d8" name="apache2-worker" arch="x86_64">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>

<package pkgid="18fefb499fc6a35400235aa9213b11b16f5f4303dce80cd860cc363ff105c602" name="apache2-worker-debuginfo" arch="x86_64">
    <version epoch="0" ver="2.4.10" rel="30.2"/>

<changelog author="crrodriguez@opensuse.org" date="1395921600">- version 2.4.9
  * SECURITY: CVE-2014-0098
  * SECURITY: CVE-2013-6438
  * multiple bugfixes and improvements to mod_ssl, mod_lua,
  mod_session and core, see CHANGES for details.</changelog>
<changelog author="lnussel@suse.de" date="1397476800">- move most ssl options to ssl-global.conf. There is usually no need
  for every vhost to re-define the ciphers for example (bnc#865582).
  Drop some commented entries that only lead to confusion.</changelog>
<changelog author="mc@suse.com" date="1405944000">- provide httpd.service as alias for apache2.service for
  compatibility reasons (bnc#888093)</changelog>
<changelog author="crrodriguez@opensuse.org" date="1405944001">- Update package Summary and Description.
- version 2.4.10
  * SECURITY: CVE-2014-0117 (cve.mitre.org)
  * SECURITY: CVE-2014-3523 (cve.mitre.org)
  * SECURITY: CVE-2014-0226 (cve.mitre.org)
  * SECURITY: CVE-2014-0118 (cve.mitre.org)
  * SECURITY: CVE-2014-0231 (cve.mitre.org)
  * Multiple bugfixes to mod_ssl, mod_cache, mod_deflate, mod_lua
  * mod_proxy_fcgi supports unix sockets.</changelog>
<changelog author="pgajdos@suse.com" date="1411560000">- fix documentation links 2.2 -&gt; 2.4 [bnc#888163] (internal)</changelog>
<changelog author="pgajdos@suse.com" date="1411646400">- ServerSignature=Off and ServerTokens=Prod by request from
  security team [bnc#716495]</changelog>
<changelog author="pgajdos@suse.com" date="1411732800">- more 2.2 -&gt; 2.4 [bnc#862058]</changelog>
<changelog author="oholecek@suse.com" date="1411732801">- allow only TCP ports in Yast2 firewall files</changelog>
<changelog author="pgajdos@suse.com" date="1411992000">- 700 permissions for /usr/sbin/apache2-systemd-ask-pass and
  /usr/sbin/start_apache2 [bnc#851627]</changelog>
<changelog author="kstreitova@suse.com" date="1412596800">- the following unused patches were removed from the package:
  * apache2-mod_ssl_npn.patch
  * httpd-2.0.49-log_server_status.dif</changelog>
<changelog author="pgajdos@suse.com" date="1412942400">- fixed link to Apache quickstart [bnc#624681], [bnc#789806]</changelog>
<changelog author="kstreitova@suse.com" date="1418385600">- added httpd-2.4.x-bnc909715-CVE-2014-8109-mod_lua_handling_of_Require_line.patch
  that fixes handling of the Require line when a LuaAuthzProvider
  is used in multiple Require directives with different arguments
  [bnc#909715], [CVE-2014-8109].</changelog>
<changelog author="kstreitova@suse.com" date="1418731200">- added httpd-2.4.x-bnc871310-CVE-2013-5704-mod_headers_chunked_requests.patch
  to fix flaw in the way mod_headers handled chunked requests. Adds
  "MergeTrailers" directive to restore legacy behavior [bnc#871310],
  [CVE-2013-5704].
- changed apache2.service file to fix situation where apache won't
  start at boot when using an encrypted certificate because user
  isn't prompted for password during boot [bnc#792309].</changelog>
<changelog author="kstreitova@suse.com" date="1419940800">- fix IfModule directive around SSLSessionCache [bnc#842377c#11].</changelog>
<changelog author="bruno@ioda-net.ch" date="1421064000">- Backport patched apache2.service to fix boo#859439 for openSUSE
  13.2, the fix seems to have lost its track on obs apache2 repo
  + service reload can cause log data to be lost with logrotate
  under some circumstances: remove "-t" from service reload.
  [bnc#859439] Thanks to bruno@ioda-net.ch!</changelog>
<changelog author="kstreitova@suse.com" date="1424692800">- add httpd-2.4.x-bnc918352-CVE-2015-0228-mod_lua_websocket_DoS.patch
  to fix mod_lua bug where a maliciously crafted websockets PING
  after a script calls r:wsupgrade() can cause a child process crash
  [CVE-2015-0228], [bnc#918352].</changelog>
<changelog author="kstreitova@suse.com" date="1428580800">- enable mod_imagemap [bnc#866366]</changelog>
<changelog author="kstreitova@suse.com" date="1430827200">- add httpd-2.4.10-split-logfile2.patch to fix split-logfile2 script
  [bnc#869790]</changelog>
<changelog author="kstreitova@suse.com" date="1434542400">- add httpd-2.4.10-LDAP_authz_failures.patch to fix 2.4.10
  regression when some LDAP searches or comparisons might be done
  with the wrong credentials when a backend connection is reused
  [bnc#930228]</changelog>
<changelog author="kstreitova@suse.com" date="1438862400">- add httpd-2.4.10-ap_some_auth_required_API_unusable.patch to
  replace ap_some_auth_required (unusable in Apache httpd 2.4)
  with new ap_some_authn_required and ap_force_authn hook
  [bnc#938723], [CVE-2015-3185]
- add httpd-2.4.10-chunk_header_parsing_defect.patch to parse chunk
  headers properly [bnc#938728], [CVE-2015-3183]
- fix Logjam vulnerability: change SSLCipherSuite cipherstring to
  disable export cipher suites and deploy Ephemeral Elliptic-Curve
  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to
  generate a strong and unique Diffie Hellman Group and append it
  to the server certificate file [bnc#931723], [CVE-2015-4000]</changelog>

</package>

</otherdata>