| Newsgroups |
gmane.comp.apache.apr.cvs |
| Message-ID |
<178611457892.3611419.2607064893599671823@svn03-he-fi> |
Author: covener
Date: Fri Aug 7 14:56:18 2026
New Revision: 86634
Log:
Add 1.6.5-rc1 files
Added:
dev/apr/CHANGES-APR-UTIL-1.6
dev/apr/apr-util-1.6.5-rc1-candidate-win32-src.zip (contents, props changed)
dev/apr/apr-util-1.6.5-rc1-candidate-win32-src.zip.asc
dev/apr/apr-util-1.6.5-rc1-candidate-win32-src.zip.sha256
dev/apr/apr-util-1.6.5-rc1-candidate.tar.bz2 (contents, props changed)
dev/apr/apr-util-1.6.5-rc1-candidate.tar.bz2.asc
dev/apr/apr-util-1.6.5-rc1-candidate.tar.bz2.sha256
dev/apr/apr-util-1.6.5-rc1-candidate.tar.gz (contents, props changed)
dev/apr/apr-util-1.6.5-rc1-candidate.tar.gz.asc
dev/apr/apr-util-1.6.5-rc1-candidate.tar.gz.sha256
Modified:
dev/apr/Announcement-aprutil-1.x.html
dev/apr/Announcement-aprutil-1.x.txt
Modified: dev/apr/Announcement-aprutil-1.x.html
==============================================================================
--- dev/apr/Announcement-aprutil-1.x.html Fri Aug 7 14:48:20 2026 (r86633)
+++ dev/apr/Announcement-aprutil-1.x.html Fri Aug 7 14:56:18 2026 (r86634)
@@ -5,7 +5,7 @@
<meta name="author" content="APR">
<meta name="email" content="[email protected]">
<link rel="stylesheet" type="text/css" href="Announcement.css">
- <title>Apache Portable Runtime Utility 1.6.4 Released</title>
+ <title>Apache Portable Runtime Utility 1.6.5 Released</title>
</head>
<body>
<div id="logo">
@@ -15,13 +15,13 @@
</div>
<h1>
- Apache Portable Runtime Utility 1.6.4 Released
+ Apache Portable Runtime Utility 1.6.5 Released
</h1>
<p>
The Apache Software Foundation and the Apache Portable Runtime
Project are proud to announce the General Availability of version
- 1.6.4 of the Apache Portable Runtime Utility library (APR-util).
+ 1.6.5 of the Apache Portable Runtime Utility library (APR-util).
</p>
<p>
Modified: dev/apr/Announcement-aprutil-1.x.txt
==============================================================================
--- dev/apr/Announcement-aprutil-1.x.txt Fri Aug 7 14:48:20 2026 (r86633)
+++ dev/apr/Announcement-aprutil-1.x.txt Fri Aug 7 14:56:18 2026 (r86634)
@@ -1,8 +1,8 @@
- Apache Portable Runtime Utility (APR-util) 1.6.4 Released
+ Apache Portable Runtime Utility (APR-util) 1.6.5 Released
The Apache Software Foundation and the Apache Portable Runtime
Project are proud to announce the General Availability of version
- 1.6.4 of the Apache Portable Runtime Utility library (APR-util).
+ 1.6.5 of the Apache Portable Runtime Utility library (APR-util).
For detailed changes in this maintenance release, see;
Added: dev/apr/CHANGES-APR-UTIL-1.6
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dev/apr/CHANGES-APR-UTIL-1.6 Fri Aug 7 14:56:18 2026 (r86634)
@@ -0,0 +1,186 @@
+ -*- coding: utf-8 -*-
+Changes with APR-util 1.6.5
+
+ *) Fix oracle DBD compilation errors introduced in 1.6.4. PR 70170.
+
+Changes with APR-util 1.6.4
+
+ *) SECURITY: CVE-2026-34502: Heap buffer overflow in APR memcached
+ client (cve.mitre.org)
+ Heap-based Buffer Overflow vulnerability in Apache Portable
+ Runtime Utility memcached client
+ This issue affects Apache Portable Runtime Utility: from 1.3.0
+ through 1.6.3.
+ Credits: Elhanan Haenel
+
+ *) SECURITY: CVE-2026-34501: Apache Portable Runtime Utility: Heap
+ buffer overflow in APR redis client (cve.mitre.org)
+ Heap-based Buffer Overflow vulnerability in Apache Portable
+ Runtime Utility redis client.
+ This issue affects Apache Portable Runtime Utility: from 1.6.0
+ through 1.6.3.
+ Users are recommended to upgrade to version 1.6.4, which fixes
+ the issue.
+ Credits: Elhanan Haenel
+
+ *) SECURITY: CVE-2026-34191: Apache Portable Runtime Utility: SQL
+ Injection in apr_dbd_oracle (cve.mitre.org)
+ Improper Neutralization of Special Elements used in an SQL
+ Command ('SQL Injection') vulnerability in Apache Portable
+ Runtime Utility via apr_dbd_oracle provider.
+ This issue affects Apache Portable Runtime Utility: from 1.6.0
+ through 1.6.3.
+ Users are recommended to upgrade to version 1.6.4, which fixes
+ the issue.
+ Credits: Elhanan Haenel
+
+ *) SECURITY: CVE-2026-32327: Apache Portable Runtime Utility:
+ apr-util XML stack recursion crash (cve.mitre.org)
+ A bug in APR-util version 1.6.3 (and earlier) allows a stack
+ recursion attack against any library consumer which parses XML
+ from untrusted sources and uses the apr_xml_quote_elem()
+ function.
+ Users are recommended to upgrade to version 1.6.4, which fixes
+ this issue.
+ Credits: Younghyo Cho @ CISLab, SeoulTech
+
+ *) SECURITY: CVE-2025-49506: apr_password_validate() vulnerable to
+ timing attack (cve.mitre.org)
+ APR-util versions 1.6.3 (and earlier) function
+ apr_password_validate() was not constant-time with regards to
+ hashes or passwords comparisons, potentially leaking their
+ content via a side channel timing attack particularly on
+ platforms without crypt() such as Windows, BeOS, NetWare, or
+ Android.
+ Users are recommended to upgrade to version 1.6.4, which fixes
+ this issue.
+ Credits: Michael Rowley <michael csirt.global>
+
+ *) apr_brigade: Don't split the final LF in apr_brigade_split_line() to
+ avoid producing an empty bucket. PR 64273
+ [Barnim Dzwillo <dzwillo strato.de>, Joe Orton]
+
+ *) apr_brigade: Metadata buckets are now ignored in
+ apr_brigade_split_line, apr_brigade_flatten and
+ apr_brigade_to_iovec, fixing possible undefined behaviour. PR 68278
+ [Ben Kallus <benjamin.p.kallus.gr dartmouth.edu>, Joe Orton]
+
+ *) apr_crypto_openssl: Compatibility with OpenSSL 3. [Yann Ylavic]
+
+ *) apr_crypto_openssl: use OPENSSL_init_crypto() to initialise OpenSSL
+ on versions 1.1+. [Graham Leggett]
+
+ *) apr_memcache: Fix name lookup to allow IPv6 as well as IPv4.
+ [Lubos Uhliarik <luhliari redhat.com>]
+
+ *) configure: Fix Berkeley DB detection with compilers enforcing
+ strict C99 compliance. PR 66396.
+ [Florian Weimer <fweimer redhat.com>]
+
+Changes with APR-util 1.6.3
+
+ *) Correct a packaging issue in 1.6.2. The contents of the release were
+ correct, but the top level directory was misnamed.
+
+Changes with APR-util 1.6.2
+
+ *) SECURITY: CVE-2022-25147 (cve.mitre.org)
+ Integer Overflow or Wraparound vulnerability in apr_base64 functions
+ of Apache Portable Runtime Utility (APR-util) allows an attacker to
+ write beyond bounds of a buffer.
+
+ *) Teach configure how to find and build against MariaDB 10.2. PR 61517
+ [Kris Karas <bugs-a17 moonlit-rail.com>]
+
+ *) apr_crypto_commoncrypto: Remove stray reference to -lcrypto that
+ prevented commoncrypto being enabled. [Graham Leggett]
+
+ *) Add --tag=CC to libtool invocations. PR 62640. [Michael Osipov]
+
+ *) apr_dbm_gdbm: Fix handling of error codes. This makes gdbm 1.14 work.
+ apr_dbm_gdbm will now also return error codes starting with
+ APR_OS_START_USEERR, as apr_dbm_berkleydb does, instead of always
+ returning APR_EGENERAL. [Stefan Fritsch]
+
+Changes with APR-util 1.6.1
+
+ *) Win32: Add function exports from new apr_crypto API's missing in 1.6.0.
+
+ *) Win32: Introduce XML_PARSER build-time variable to select the expat
+ library name to be linked to libaprutil-1.dll. See Makefile.win
+
+ *) Win32: Removed lingering xml/xml.dsp project forked from the expat
+ Project in the 1.9x era. Use expat's maintained build schema instead,
+ prior to building apr-util.
+
+ *) apr_crypto: Fix compatibility with LibreSSL. PR 61596.
+ [Bernard Spil <brnrd freebsd.org>, Yann Ylavic]
+
+ *) sdbm: better database/page validation to fail cleanly when corrupted.
+ [Yann Ylavic]
+
+Changes with APR-util 1.6.0
+
+ *) The expat dependency of apr-util is no longer built with apr-util.
+ Install expat (including development headers and libraries) first
+ before building apr-util. [https://libexpat.github.io/]
+
+ *) Mark apr_dbd_freetds as unsupported, and remove it from all builds
+ [Nick Kew]
+
+ *) Update MySQL build to stop using libmysqlclient_r.
+ [Petr Sumbera <petr.sumbera oracle.com>]
+
+ *) apr_buckets: Add apr_bucket_file_set_buf_size() which allows to configure
+ the size of the buffer used to read files. [Yann Ylavic]
+
+ *) apr_crypto: avoid excessive iteration in bcrypt hash.
+ [Hanno Böck <hanno hboeck.de>]
+
+ *) apr_siphash: Implement keyed hash function SipHash. [Yann Ylavic]
+
+ *) apr_crypto: Add apr_crypto_key() function which supports keys
+ generated from a passphrase or a raw secret provided by the caller.
+ Deprecate apr_crypto_passphrase(). [Graham Leggett]
+
+ *) apr_crypto_nss: Ensure the SECItem returned by PK11_ParamFromIV
+ is properly freed. [Graham Leggett]
+
+ *) apr_crypto: Don't cache the driver if initialisation fails. This
+ stops the second and subsequent attempt to use the API from failing
+ claiming the library is not initialised. [Graham Leggett]
+
+ *) apr_crypto: Add a native CommonCrypto implementation for iOS and OSX
+ where OpenSSL has been deprecated. [Graham Leggett]
+
+ *) apr_xml_to_text: Add style APR_XML_X2T_PARSED to maintain a
+ consistent namespace prefix. [Jari Urpalainen
+ <jari.urpalainen nokia.com>]
+
+Changes with APR-util 1.5.x and later:
+
+ *) http://svn.apache.org/viewvc/apr/apr-util/branches/1.5.x/CHANGES?view=markup
+
+Changes with APR-util 1.4.x and later:
+
+ *) http://svn.apache.org/viewvc/apr/apr-util/branches/1.4.x/CHANGES?view=markup
+
+Changes for APR-util 1.3.x and later:
+
+ *) http://svn.apache.org/viewvc/apr/apr-util/branches/1.3.x/CHANGES?view=markup
+
+Changes for APR-util 1.2.x and later:
+
+ *) http://svn.apache.org/viewvc/apr/apr-util/branches/1.2.x/CHANGES?view=markup
+
+Changes for APR-util 1.1.x and later:
+
+ *) http://svn.apache.org/viewvc/apr/apr-util/branches/1.1.x/CHANGES?view=markup
+
+Changes for APR-util 1.0.x and later:
+
+ *) http://svn.apache.org/viewvc/apr/apr-util/branches/1.0.x/CHANGES?view=markup
+
+Changes for APR-util 0.9.x and later/earlier:
+
+ *) http://svn.apache.org/viewvc/apr/apr-util/branches/0.9.x/CHANGES?view=markup
Added: dev/apr/apr-util-1.6.5-rc1-candidate-win32-src.zip
==============================================================================
Binary file. No diff available.
Added: dev/apr/apr-util-1.6.5-rc1-candidate-win32-src.zip.asc
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dev/apr/apr-util-1.6.5-rc1-candidate-win32-src.zip.asc Fri Aug 7 14:56:18 2026 (r86634)
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQJjBAABCgBNFiEEZbLUT+dL1ePeOsPwgngd5G1ZVPoFAmp18ccbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzExxjb3ZlbmVyQGFwYWNoZS5vcmcACgkQgngd5G1Z
+VPqmaQ//Rqtwlp34myIYTN/Jsv1EW6+ye+QQ/RTDmDQvUX60xsOOiDWYFMU6QW4i
+SwjlCnBbmu2g1YGLk7a6e8hUYg7SIcPdI8Ps+4jjMXB2q7QV+M9hA5wo/yYYwy01
+fidfUOg4BiYb83f0ZOzNw5jpuGxSSXrr6Ko+nA/W0e/ioWMzmHX1YV7wEmjIhwuw
+Gobh0hcGod6bjAaCwIHNuBlir8VYBdwZfoGCPopu2lAjMzvDHmRpXxP8ym9sO7TW
+K4DcCP7ffFg8hQm6PgDl7EiBY+WTWvHhpE8blWZMshnC0vOryQRNL41bL3fgJw8Y
+Q/Ftvz9Wp6oCPNVopbjkW0dcxJHhZ16g5QSyCu1Qg+bSSIrTNth5h953B5Ej42Hn
+MBIskRNT9fTV5EKZgcmaFGEInAgVp6QZMrtPDjxzq3HZ3cGaIie3XsykvvX7oTsU
+JJO1wyeBY8wzf8rUgUWo769gRKqkZ0d0n3M7orXf6BX66hQLrYjsAhwATsiovJZr
+6Lppswrf/wi5dXesQrFoDxWZprzjgfXJQ9+Obxul2aTNcslwHiA2oPtJBnxK2OnL
+1VYHVPG4QwIVGq40DO0LhxNxqS9gYTuAiP8Oe6olSlhRC8kUIeqLkGogbbamUw8Z
+ttmx+tlTpKSzkaLEgMoOyGz15ZD0xPpc+KE2/uimY/AEDvtlBlM=
+=wlYm
+-----END PGP SIGNATURE-----
Added: dev/apr/apr-util-1.6.5-rc1-candidate-win32-src.zip.sha256
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dev/apr/apr-util-1.6.5-rc1-candidate-win32-src.zip.sha256 Fri Aug 7 14:56:18 2026 (r86634)
@@ -0,0 +1 @@
+77f3ae9c22d33281beb13737af05441c3257a839c89d12844490cfb27f2ef9a1 *apr-util-1.6.5-rc1-candidate-win32-src.zip
Added: dev/apr/apr-util-1.6.5-rc1-candidate.tar.bz2
==============================================================================
Binary file. No diff available.
Added: dev/apr/apr-util-1.6.5-rc1-candidate.tar.bz2.asc
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dev/apr/apr-util-1.6.5-rc1-candidate.tar.bz2.asc Fri Aug 7 14:56:18 2026 (r86634)
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQJjBAABCgBNFiEEZbLUT+dL1ePeOsPwgngd5G1ZVPoFAmp18ccbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzExxjb3ZlbmVyQGFwYWNoZS5vcmcACgkQgngd5G1Z
+VPrgPg//WXMKa6ZJ53ORDevOJ3SQNf//GyixckTP5W6DAxht8lwd7WDoCAX0M8Ng
+srrPfTgVDEdFMW2Rk1F8U6oINW5SrWfZR+htdU5A7mYW+99bhB70RSjkpCpomSML
+R6xIlAQ8Zw2NI0o86rOpLB8YUoTiBEgzRN99HOM49pols+29RP1r9bo7PWv3vEGh
+nQ9qQcliLx/DbWIFi4yDRxQfkl3aAE2PmkGpcmaM7uK0umTQvxpBtSlxYwnnaTg4
+FEVPB161MoOHdkn6NUIY6ACRVXB741o0ZzX/FnisHDZWrQDTmhTGMeujUvZmxaQv
+LI+pTWYorotQFGfbgRNXHo+GFLk3bejXqJ3N/7UsMGlsuPX6C/xSE41mVNihO/iH
+IJYCgUIFF5/PJMv9OK9z0jpuTOeVS5tOgFPjnAL/VXP4VBx9k/59bjsoQI54uEUF
+YmLP14D5vEpC9TcQ0Di8nV3YtgVBEvQrs1wr6gE+27K5KB8934BCcd2QFAQhcRyC
+vkJttel8wWurRG4CEFNa3WWB+pgRFm3WcPfCnrI6dph0RY8lwFyF7HIDA+T7NZEg
+7+tR9Q7f/c1Rp3FbNd+LU7WTo4Ua63JowJaPZyuvmoayK3SxL1ebStm29P9fbsJY
+RRiBwOJpNI4GL1bWvGjwd8qnZfm7NLy4yGJews/C/SGR2FW+SCs=
+=Mzfg
+-----END PGP SIGNATURE-----
Added: dev/apr/apr-util-1.6.5-rc1-candidate.tar.bz2.sha256
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dev/apr/apr-util-1.6.5-rc1-candidate.tar.bz2.sha256 Fri Aug 7 14:56:18 2026 (r86634)
@@ -0,0 +1 @@
+96de1dd6f6a0476d2d2e7964926d8c1ddc3bb0e210e1b1812d3ba5a454a392e2 *apr-util-1.6.5-rc1-candidate.tar.bz2
Added: dev/apr/apr-util-1.6.5-rc1-candidate.tar.gz
==============================================================================
Binary file. No diff available.
Added: dev/apr/apr-util-1.6.5-rc1-candidate.tar.gz.asc
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dev/apr/apr-util-1.6.5-rc1-candidate.tar.gz.asc Fri Aug 7 14:56:18 2026 (r86634)
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQJjBAABCgBNFiEEZbLUT+dL1ePeOsPwgngd5G1ZVPoFAmp18ccbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzExxjb3ZlbmVyQGFwYWNoZS5vcmcACgkQgngd5G1Z
+VPo4Lg/9HWOjgO06OgWyc5idTY0gy3sNLabUyPr9AAqMnSyt0w+aTJ3TDHGwTdUM
+Z4CSakz8fXvDUOS9MWLeVSVOg45fURfWiBwNffkBJNHTtcNJSR86QTstBuRM34PX
+G0WHoele5FVBif0rv3n8hHCvrjoCJPcUH2loZEw4oxBtuqXSomOqtlHATWKwYbKT
+OrEl/0TpILO3265deJih+7AbwrxeVuWJTjklB5utLgTYtwWBErl9Lr0Rsa/h0W56
+dA0r1qznHA6bbdMF6e+ZLSvP8iQeZJrYVGo2ofYP+2EP/4atoH4/ZDqLTeSTG51M
+XTyuM4/j6jKL2scZWX+1RagkuJwSA8e0Kj4xtv/j5isUxF+OWk5kToVIAzvE4W+M
+xWh94UD7nPlyDjI6TaI7MxRxaw7vjFESTF9AMMV+i4ZaJmbFmxLvCbLuPBGLSCJz
+uLu9pk5ItKGUJHKGoNWgQPtuXo7uBi7MBRAlRugXDLsvD4hw/vLO+fXXLHsuZQoS
+4CKddbd//OB4Bl69tVhauKFxqJW16z4TnYGEJYhE/eHJkhXdD8duHPiIke81RXzd
+GPP5k2iSxYT1lHcvN0kdsKxPAHsy7AnYdbeYE5ahSwCXIKt/l9q2dof8mvDIiIP1
+S1moI9D1HnTYrqNEPvEU8Zt1/CyRaPdST7O4MOTQyFNbmOLAqjY=
+=t92r
+-----END PGP SIGNATURE-----
Added: dev/apr/apr-util-1.6.5-rc1-candidate.tar.gz.sha256
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dev/apr/apr-util-1.6.5-rc1-candidate.tar.gz.sha256 Fri Aug 7 14:56:18 2026 (r86634)
@@ -0,0 +1 @@
+f43a1c8c79eef497a022ec6c99dddbdf57e42001da6ccbfae259631ed5aa2805 *apr-util-1.6.5-rc1-candidate.tar.gz