From owner-freebsd-questions@FreeBSD.ORG Mon Apr 12 13:32:16 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 65A0A16A4CE for ; Mon, 12 Apr 2004 13:32:16 -0700 (PDT) Received: from smtp.infracaninophile.co.uk (smtp.infracaninophile.co.uk [81.2.69.218]) by mx1.FreeBSD.org (Postfix) with ESMTP id 05F6843D46 for ; Mon, 12 Apr 2004 13:32:15 -0700 (PDT) (envelope-from m.seaman@infracaninophile.co.uk) Received: from happy-idiot-talk.infracaninophile.co.uk (localhost.infracaninophile.co.uk [IPv6:::1])i3CKWAC3070105 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 12 Apr 2004 21:32:10 +0100 (BST) (envelope-from matthew@happy-idiot-talk.infracaninophile.co.uk) Received: (from matthew@localhost)id i3CKW9sa070104; Mon, 12 Apr 2004 21:32:09 +0100 (BST) (envelope-from matthew) Date: Mon, 12 Apr 2004 21:32:09 +0100 From: Matthew Seaman To: Chuck Swiger Message-ID: <20040412203209.GA69747@happy-idiot-talk.infracaninophile.co.uk> Mail-Followup-To: Matthew Seaman , Chuck Swiger , questions@freebsd.org References: <20040412095020.M76613@maa-net.net> <20040412102829.GB7692@happy-idiot-talk.infracaninophile.co.uk> <407AF080.5070109@mac.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="fUYQa+Pmc3FrFX/N" Content-Disposition: inline In-Reply-To: <407AF080.5070109@mac.com> User-Agent: Mutt/1.5.6i X-Spam-Status: No, hits=-4.8 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=2.63 X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on happy-idiot-talk.infracaninophile.co.uk X-Virus-Scanned: clamd / ClamAV version devel-20040407, clamav-milter version 0.70g cc: questions@freebsd.org Subject: Re: apache13-modssl X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Apr 2004 20:32:16 -0000 --fUYQa+Pmc3FrFX/N Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Apr 12, 2004 at 03:39:44PM -0400, Chuck Swiger wrote: > Matthew Seaman wrote: > [ ... ] > >Your friend is being unnecessarily alarmist. apache2 is not > >significantly different to apache13 in security terms. >=20 > There have been 16 CVE entries list for Apache 2, and 8 for Apache 1.x: >=20 > http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=3Dapache+2 > http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=3Dapache+1 Errr -- did you look at the lists of entries those searches actually turn up? Quite a few of the entries for the 'apache+2' search are actually apache-1.3.x specific... In fact, by my reckoning most of the CVE entries which are generic apache problems (i.e. they aren't OS or distribution specific, or they don't depend on some 3rd party code, like PHP) -- most of those apply equally to both apache-1.3.x and apache-2.0.x. If you search for the currently released apache versions, there are 2 entries mentioning apache-1.3.29 (one of which is actually for versions *before* 1.3.29), and also 2 mentioning apache-2.0.49 (again one of which only applies to versions *before* 2.0.49) I don't think that simply counting CVE entries is going to tell you very much useful. Cheers, Matthew --=20 Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way PGP: http://www.infracaninophile.co.uk/pgpkey Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK --fUYQa+Pmc3FrFX/N Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD8DBQFAevzJdtESqEQa7a0RAtsTAKCKGwWMn8YGMc64DzrxxOa7YRYoZwCfUBjr d0dlZigamMBSITB+6ILeNHE= =pNoE -----END PGP SIGNATURE----- --fUYQa+Pmc3FrFX/N--