- update 2.4.37
  see also http://www.apache.org/dist/httpd/CHANGES_2.4.37

- update 2.4.35
  see also http://www.apache.org/dist/httpd/CHANGES_2.4.35

- update 2.4.34
  see also http://www.apache.org/dist/httpd/CHANGES_2.4.34
- security issues
  . CVE-2018-8011 mod_md
    DoS via Coredumps on specially crafted requests
  . CVE-2018-1333 mod_http2
    DoS for HTTP/2 connections by specially crafted requests

- update 2.4.33
  see also http://www.apache.org/dist/httpd/CHANGES_2.4.33
  see also http://www.apache.org/dist/httpd/CHANGES_2.4.32
  see also http://www.apache.org/dist/httpd/CHANGES_2.4.29
- add mod_md module
- security issues
  . CVE-2017-15710 mod_authnz_ldap:
    Out of bound write with AuthLDAPCharsetConfig enabled
  . CVE-2017-15715 core:
    Configure the regular expression engine to match '$' to the end of
    the input string only, excluding matching the end of any embedded 
    newline characters. Behavior can be changed with new directive 
    'RegexDefaultOptions'.
  . CVE-2018-1283 mod_session:
    CGI-like applications that intend to read from mod_session's 
    'SessionEnv ON' could be fooled into reading user-supplied data instead.
  . CVE-2018-1301 core:
    Possible crash with excessively long HTTP request headers. 
    Impractical to exploit with a production build and production LogLevel.
  . CVE-2018-1302 mod_http2: Potential crash w/ mod_http2
  . CVE-2018-1303 mod_cache_socache:
    Fix request headers parsing to avoid a possible crash
    with specially crafted input data.
  . CVE-2018-1312 mod_auth_digest:
    Fix generation of nonce values to prevent replay
    attacks across servers using a common Digest domain. This change
    may cause problems if used with round robin load balancers.

- update 2.4.28
  see also http://www.apache.org/dist/httpd/CHANGES_2.4.28
- security issues
  . CVE-2017-9798
    Corrupted or freed memory access.
  . PR61382
    mod_http2: Fix for stalling when more than 32KB are written to a suspended stream.

- update 2.4.27
  see also http://www.apache.org/dist/httpd/CHANGES_2.4.27
- security issues
  . CVE-2017-7679
  . CVE-2017-7668
  . CVE-2017-7659
  . CVE-2017-3169
  . CVE-2017-3167

- update 2.4.25
  see also http://www.apache.org/dist/httpd/CHANGES_2.4.25
- security issues
  . CVE-2016-8740
  . CVE-2016-2161
  . CVE-2016-0736
  . CVE-2016-8743

- support package name alias http-ssl, http-ldap, http-proxy-html, http-session

- update 2.4.23
- security issues
  . CVE-2016-5387
    The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and
    therefore does not protect applications from the presence of untrusted
    client data in the HTTP_PROXY environment variable, which might allow
    remote attackers to redirect an application's outbound HTTP traffic to an
    arbitrary proxy server via a crafted Proxy header in an HTTP request, aka
    an "httpoxy" issue.

- move ssl.conf to httpd-conf package

- support ALPN for http2

- update 2.4.18

- fixed perl dependency problems

- update 2.4.17

- update 2.4.16
- security issues
  . CVE-2015-3183
  . CVE-2015-3185
  . CVE-2015-0253
  . CVE-2015-0228

- update 2.4.12
- add External404Title directive
- fixed broken korean in SSI