Merge ~bryce/ubuntu/+source/apache2:merge-v2.4.51-2-jammy into ubuntu/+source/apache2:debian/sid

[Bryce Harrington]

Bunch of CVEs drop with this merge, but the remaining delta stays with us. The openssl3 changes are still valid for this release, but originated from upstream so will eventually be droppable.

With this merge, we also revert the graceful sru/fix for systemd as was recently done for other releases.

Autopgktests passed locally. I'll queue up PPA tests once the PPA has finished building.

PPA: https://launchpad.net/~bryce/+archive/ubuntu/apache2-merge-v2.4.51-2

Usual tags pushed for review:

- tags/old/debian 517f14a34
- tags/new/debian 826e1a24b
- tags/old/ubuntu 2317e7e30
- tags/logical/2.4.48-3.1ubuntu4 ca88b20c2
- tags/reconstruct/2.4.48-3.1ubuntu4 1b5106881
- tags/split/2.4.48-3.1ubuntu4 9a6855775

[Christian Ehrhardt  (paelzer)]

This is still marked WIP, is it ready for review @bryce?

[Bryce Harrington (bryce)]

Yep, it's ready for review.

It was in WIP since I was waiting on some PPA tests to complete:

https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-bryce-apache2-merge-v2.4.51-2/jammy/s390x/a/apache2/20211203_075202_4dd22@/log.gz
https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-bryce-apache2-merge-v2.4.51-2/jammy/ppc64el/a/apache2/20211203_075304_4dd22@/log.gz
https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-bryce-apache2-merge-v2.4.51-2/jammy/armhf/a/apache2/20211203_082509_37178@/log.gz
https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-bryce-apache2-merge-v2.4.51-2/jammy/arm64/a/apache2/20211203_082428_b9dbe@/log.gz
https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-bryce-apache2-merge-v2.4.51-2/jammy/amd64/a/apache2/20211203_080400_7eeb0@/log.gz

Results for amd64:
autopkgtest [08:03:33]: test chroot: - - - - - - - - - - results - - - - - - - - - -
chroot PASS
autopkgtest [08:03:33]: @@@@@@@@@@@@@@@@@@@@ summary
run-test-suite PASS
duplicate-module-load PASS
htcacheclean PASS
default-mods PASS
ssl-passphrase PASS
check-http2 PASS
chroot PASS

(Oddly, lp-test-ppa reports these test logs as "Broken Test Log" which seems weird but I'm seeing no evidence of actual problems so wonder if that might just be a glitch in lp-test-ppa.)

[Christian Ehrhardt  (paelzer)]

For the test logs, it runs into:
  'utf-8' codec can't decode byte 0xa0 in position 1404450: invalid start byte

Firefox, Chroma and gunzip can extract it well.
But it isn't the extraction, but the following UTF convert anyway.

That is reproducible fetching the the log file and running:
import gzip
with gzip.open("log.gz") as f:
    f.read().decode("utf-8")

UnicodeDecodeError: 'utf-8' codec can't decode byte 0xa0 in position 1404450: invalid start byte

00156E18 6E 48 6F 73 74 3A 20 61 62 63 A0 5C 72 5C 6E 5C 72 5C 6E 0A 23 20 65 78 70 65 63 74 69 6E 67 20 32 30 30 2C 20 67 6F 74 nHost: abc.\r\n\r\n.# expecting 200, got

Terminal/Vim renders that as a "." but the usual "." isn't A0 but 0A.

Type is reported as UTF-8
log-unp: UTF-8 Unicode text, with very long lines, with CRLF, CR, LF line terminators

It isn't the python code that is wrong, other tools agree

$ iconv -f UTF-8 log-unp -o /dev/null
iconv: illegal input sequence at position 1404450

So maybe we should make our tool more tolerant as well.
Using errors="replace" makes this work much better.

The other decodes shall stay strict IMHO.

Pushed to the tools repo

[Christian Ehrhardt  (paelzer)]

And with that I can confirm test results are indeed good.

[Christian Ehrhardt  (paelzer)]

I think there is an issue in 5df3515d42

Somehow when applying the delta we reverted some of the Debian changes.
Salsa commit c91b4db1e91a9b6d5a66d132740830b6310c3263 has:

@@ -45,16 +45,13 @@ Recommends: ssl-cert
 Suggests: apache2-doc,
           apache2-suexec-pristine | apache2-suexec-custom,
           www-browser
-Pre-Depends: dpkg (>= 1.17.14),
- ${misc:Pre-Depends}
-Breaks: libapache2-mod-proxy-uwsgi (<< 2.4.33)
+Pre-Depends: ${misc:Pre-Depends}

But we now undo that in 5df3515d42

I think that is a bad rebase and needs fixup

(Shown by range-diff)

review: Needs Fixing

[Christian Ehrhardt  (paelzer)]

The Revert of "systemd for graceful" should still be listed under "Dropped" IMHO.
And the good statement "This introduced a performance regression." maybe in [] as we usually do it when quoting reasons for drops.

I see what you wanted with the revert, but IMHO it confuses (at least me)

review: Needs Fixing

[Christian Ehrhardt  (paelzer)]

The new
952c00489a - d/apache2ctl: Also use /run/systemd to check for systemd usage (LP: 1918209)

Has become a single whitespace change, that seems wrong.
I think you can remove the commit and mention it in the changelog to be dropped.

Or we need to fully add it again.

Looking at the new apache2ctl it is now a variable instead of a function, but in Docker still might yield false results. So I assume you need adapt that to match and then send it to Debian.

Or if OTOH this isn't needed anymore with the revert of the graceful changes mention that and fully drop it.

review: Needs Fixing

[Christian Ehrhardt  (paelzer)]

Ack to the Drop of the CVEs, they are present in Debian.

[Christian Ehrhardt  (paelzer)]

An unimportant improvement in changelog/commit message:
  "failure to load when using OpenSSL 3. (LP #1951476)"
has a double space

In general I see some use double space (also 1288690) and others do not.
Maybe on this merge&rebase unify commit messages and changelog to eiter one?

2257354... by Bryce Harrington on 2021-12-16

merge-changelogs

e249e4c... by Bryce Harrington on 2021-12-16

reconstruct-changelog

[Bryce Harrington (bryce)]

Thank you for the thorough review comments, sorry took so long to get back to it (so many distractions!) Anyway, I agree with all your suggestions, have made all the changes, and am pushing the updated branch here for re-review. Thanks again!

[Andreas Hasenack (ahasenack)]

I'm taking a look

[Andreas Hasenack (ahasenack)]

Looks good

review: Approve

[Bryce Harrington (bryce)]

Thanks, uploaded.

$ grep "^Vcs-Git" *source.changes
Vcs-Git: https://git.launchpad.net/~bryce/ubuntu/+source/apache2
Vcs-Git-Commit: e249e4c816da6f89181fa734e8f324ed03a10eef
Vcs-Git-Ref: refs/heads/merge-v2.4.51-2-jammy

$ dput ubuntu apache2_2.4.51-2ubuntu1_source.changes
D: Setting host argument.
Checking signature on .changes
gpg: /home/bryce/pkg/Apache2/merge-v2.4.51-2/apache2_2.4.51-2ubuntu1_source.changes: Valid signature from E603B2578FB8F0FB
Checking signature on .dsc
gpg: /home/bryce/pkg/Apache2/merge-v2.4.51-2/apache2_2.4.51-2ubuntu1.dsc: Valid signature from E603B2578FB8F0FB
Package includes an .orig.tar.gz file although the debian revision suggests
that it might not be required. Multiple uploads of the .orig.tar.gz may be
rejected by the upload queue management software.
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading apache2_2.4.51-2ubuntu1.dsc: done.
  Uploading apache2_2.4.51.orig.tar.gz: done.
  Uploading apache2_2.4.51-2ubuntu1.debian.tar.xz: done.
  Uploading apache2_2.4.51-2ubuntu1_source.buildinfo: done.
  Uploading apache2_2.4.51-2ubuntu1_source.changes: done.
Successfully uploaded packages.

[Andreas Hasenack (ahasenack)]

This migrated, please mark as "merged" when able.

[Bryce Harrington (bryce)]

Done, thanks!

diff --git a/debian/apache2-bin.install b/debian/apache2-bin.install
index 63c573f..3d1bdf1 100644
--- a/debian/apache2-bin.install
+++ b/debian/apache2-bin.install
@@ -1,2 +1,3 @@
 /usr/lib/apache2/modules/
 /usr/sbin/apache2
+debian/apache2.py usr/share/apport/package-hooks
diff --git a/debian/apache2-utils.ufw.profile b/debian/apache2-utils.ufw.profile
 new file mode 100644
index 0000000..974a655
--- /dev/null
+++ b/debian/apache2-utils.ufw.profile
@@ -0,0 +1,14 @@
+[Apache]
+title=Web Server
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=80/tcp
+
+[Apache Secure]
+title=Web Server (HTTPS)
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=443/tcp
+
+[Apache Full]
+title=Web Server (HTTP,HTTPS)
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=80,443/tcp
diff --git a/debian/apache2.dirs b/debian/apache2.dirs
index 6089013..1aa6d3c 100644
--- a/debian/apache2.dirs
+++ b/debian/apache2.dirs
@@ -10,3 +10,4 @@ var/cache/apache2/mod_cache_disk
 var/lib/apache2
 var/log/apache2
 var/www/html
+/etc/ufw/applications.d/apache2
diff --git a/debian/apache2.install b/debian/apache2.install
index b6ad789..92865fc 100644
--- a/debian/apache2.install
+++ b/debian/apache2.install
@@ -8,3 +8,4 @@ debian/config-dir/*.conf			/etc/apache2
 debian/config-dir/envvars			/etc/apache2
 debian/config-dir/magic				/etc/apache2
 debian/debhelper/apache2-maintscript-helper	/usr/share/apache2/
+debian/apache2-utils.ufw.profile /etc/ufw/applications.d/
diff --git a/debian/apache2.postrm b/debian/apache2.postrm
index a68583c..b0e5d7b 100644
--- a/debian/apache2.postrm
+++ b/debian/apache2.postrm
@@ -33,6 +33,7 @@ is_default_index_html () {
 		776221a94e5a174dc2396c0f3f6b6a74
 		c481228d439cbb54bdcedbaec5bbb11a
 		e2620d4a5a0f8d80dd4b16de59af981f
+		3526531ccd6c6a1d2340574a305a18f8
 	EOF
 }
 
diff --git a/debian/apache2.py b/debian/apache2.py
 new file mode 100644
index 0000000..a9fb9d8
--- /dev/null
+++ b/debian/apache2.py
@@ -0,0 +1,48 @@
+#!/usr/bin/python
+
+'''apport hook for apache2
+
+(c) 2010 Adam Sommer.
+Author: Adam Sommer <[e-mail]>
+
+This program is free software; you can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by the
+Free Software Foundation; either version 2 of the License, or (at your
+option) any later version.  See http://www.gnu.org/copyleft/gpl.html for
+the full text of the license.
+'''
+
+from apport.hookutils import *
+import os
+
+SITES_ENABLED_DIR = '/etc/apache2/sites-enabled/'
+
+def add_info(report, ui):
+    if os.path.isdir(SITES_ENABLED_DIR):
+        response = ui.yesno("The contents of your " + SITES_ENABLED_DIR + " directory "
+                            "may help developers diagnose your bug more "
+                            "quickly.  However, it may contain sensitive "
+                            "information.  Do you want to include it in your "
+                            "bug report?")
+
+        if response == None: # user cancelled
+            raise StopIteration
+
+        elif response == True:
+            # Attache config files in /etc/apache2/sites-enabled and listing of files in /etc/apache2/conf.d 
+            for conf_file in os.listdir(SITES_ENABLED_DIR):
+                attach_file_if_exists(report, SITES_ENABLED_DIR + conf_file, conf_file)
+
+    try:
+        report['Apache2ConfdDirListing'] = str(os.listdir('/etc/apache2/conf.d'))
+    except OSError:
+        report['Apache2ConfdDirListing'] = str(False)
+
+    # Attach default config files if changed.
+    attach_conffiles(report, 'apache2', conffiles=None)
+
+    # Attach the error.log file.
+    attach_file(report, '/var/log/apache2/error.log', key='error.log')
+
+    # Get loaded modules.
+    report['Apache2Modules'] = root_command_output(['/usr/sbin/apachectl', '-D DUMP_MODULES'])
diff --git a/debian/apache2ctl b/debian/apache2ctl
index 404b9f9..02f3bca 100755
--- a/debian/apache2ctl
+++ b/debian/apache2ctl
@@ -143,6 +143,21 @@ mkdir_chown () {
     fi
 }
 
+need_systemd () {
+    # Detect if systemd is in use and should be used for managing
+    # the Apache2 httpd service.  Returns 0 if so, 1 otherwise.
+    if [ -z "${APACHE_STARTED_BY_SYSTEMD}" ]; then
+	case "$(readlink -f /proc/1/exe)" in
+	    *systemd*)
+		return 0
+		;;
+	esac
+	# With Docker, /proc/1 is not necessarily an init system,
+	# so fallback to checking in /run.
+        [ -d /run/systemd/system ]
+    fi
+    return 1
+}
 
 [ ! -d ${APACHE_RUN_DIR:-/var/run/apache2} ] && mkdir -p ${APACHE_RUN_DIR:-/var/run/apache2}
 [ ! -d ${APACHE_LOCK_DIR:-/var/lock/apache2} ] && mkdir_chown ${APACHE_RUN_USER:-www-data} ${APACHE_LOCK_DIR:-/var/lock/apache2}
@@ -153,38 +168,38 @@ start)
     # (this is bad if there are several apache2 instances running)
     rm -f ${APACHE_RUN_DIR:-/var/run/apache2}/*ssl_scache*
 
-    need_systemd=false
-    if [ -z "$APACHE_STARTED_BY_SYSTEMD" ] ; then
-        case "$(readlink -f /proc/1/exe)" in
-        *systemd*)
-            need_systemd=true
-            ;;
-        *)
-            ;;
-        esac
-    fi
-    if $need_systemd ; then
+    if need_systemd; then
         # If running on systemd we should not start httpd without systemd
         # or systemd will get confused about the status of httpd.
-        echo "Invoking 'systemctl start $APACHE_SYSTEMD_SERVICE'."
-        echo "Use 'systemctl status $APACHE_SYSTEMD_SERVICE' for more info."
-        systemctl start "$APACHE_SYSTEMD_SERVICE"
+        echo "Invoking 'systemctl start ${APACHE_SYSTEMD_SERVICE}'."
+        echo "Use 'systemctl status ${APACHE_SYSTEMD_SERVICE}' for more info."
+        systemctl start "${APACHE_SYSTEMD_SERVICE}"
     else
         unset APACHE_STARTED_BY_SYSTEMD
-        $HTTPD ${APACHE_ARGUMENTS} -k "$ARGV"
+        ${HTTPD} ${APACHE_ARGUMENTS} -k "${ARGV}"
     fi
 
     ERROR=$?
     ;;
 stop|graceful-stop)
-    $HTTPD ${APACHE_ARGUMENTS} -k "$ARGV"
+    ${HTTPD} ${APACHE_ARGUMENTS} -k "$ARGV"
     ERROR=$?
     ;;
 restart|graceful)
     if $HTTPD ${APACHE_ARGUMENTS} -t 2> /dev/null ; then
-        $HTTPD ${APACHE_ARGUMENTS} -k "$ARGV"
+        if need_systemd; then
+            # If running on systemd we should not directly restart httpd since
+            # systemd would be confused about httpd's status.
+            # (See LP: #1832182)
+            echo "Invoking 'systemctl restart ${APACHE_SYSTEMD_SERVICE}'."
+            echo "Use 'systemctl status ${APACHE_SYSTEMD_SERVICE}' for more info."
+            systemctl restart "${APACHE_SYSTEMD_SERVICE}"
+        else
+            unset APACHE_STARTED_BY_SYSTEMD
+            ${HTTPD} ${APACHE_ARGUMENTS} -k "${ARGV}"
+        fi
     else
-        $HTTPD ${APACHE_ARGUMENTS} -t
+        ${HTTPD} ${APACHE_ARGUMENTS} -t
     fi
     ERROR=$?
     ;;
diff --git a/debian/changelog b/debian/changelog
index 2a8d158..a17c195 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,60 @@
+<<<<<<< debian/changelog
+=======
+apache2 (2.4.51-2ubuntu1) jammy; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+      (LP 261198)
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+      (LP 609177)
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
+      d/s/include-binaries: replace Debian with Ubuntu on default
+      page and add Ubuntu icon file.
+      (LP 1288690)
+    - d/p/support-openssl3-*.patch: Backport various patches from
+      https://github.com/apache/httpd/pull/258 in order to fix mod_ssl's
+      failure to load when using OpenSSL 3.
+      (LP #1951476)
+  * Dropped:
+    - d/apache2ctl: Also use systemd for graceful if it is in use.
+      (LP: 1832182)
+      [This introduced a performance regression.]
+    - d/apache2ctl: Also use /run/systemd to check for systemd usage.
+      (LP 1918209)
+      [Not needed]
+    - debian/patches/CVE-2021-33193.patch: refactor request parsing in
+      include/ap_mmn.h, include/http_core.h, include/http_protocol.h,
+      include/http_vhost.h, modules/http2/h2_request.c, server/core.c,
+      server/core_filters.c, server/protocol.c, server/vhost.c.
+      [Fixed in 2.4.48-4]
+    - debian/patches/CVE-2021-34798.patch: add NULL check in
+      server/scoreboard.c.
+      [Fixed in 2.4.49-1]
+    - debian/patches/CVE-2021-36160.patch: fix PATH_INFO setting for
+      generic worker in modules/proxy/mod_proxy_uwsgi.c.
+      [Fixed in 2.4.49-1]
+    - debian/patches/CVE-2021-39275.patch: fix ap_escape_quotes
+      substitution logic in server/util.c.
+      [Fixed in 2.4.49-1]
+    - arbitrary origin server via crafted request uri-path
+      + debian/patches/CVE-2021-40438-pre1.patch: faster unix socket path
+        parsing in the "proxy:" URL in modules/proxy/mod_proxy.c,
+        modules/proxy/proxy_util.c.
+      + debian/patches/CVE-2021-40438.patch: add sanity checks on the
+        configured UDS path in modules/proxy/proxy_util.c.
+      [Fixed in 2.4.49-3]
+    - SECURITY REGRESSION: Issues in UDS URIs.  (LP #1945311)
+      + debian/patches/CVE-2021-40438-2.patch: Fix UDS unix: scheme for P
+        rules in modules/mappers/mod_rewrite.c.
+      + debian/patches/CVE-2021-40438-3.patch: Handle UDS URIs with empty
+        hostname in modules/mappers/mod_rewrite.c,
+        modules/proxy/proxy_util.c.
+      [Fixed in 2.4.49-3]
+
+ -- Bryce Harrington <[e-mail]>  Thu, 16 Dec 2021 14:09:26 -0800
+
+>>>>>>> debian/changelog
 apache2 (2.4.51-2) unstable; urgency=medium
 
   * Add patch to have new macro_ignore_empty and macro_ignore_bad_nesting parameters
@@ -61,6 +118,77 @@ apache2 (2.4.48-4) unstable; urgency=medium
 
  -- Yadd <[e-mail]>  Thu, 12 Aug 2021 11:37:43 +0200
 
+<<<<<<< debian/changelog
+=======
+apache2 (2.4.48-3.1ubuntu4) jammy; urgency=medium
+
+  * d/p/support-openssl3-*.patch: Backport various patches from
+    https://github.com/apache/httpd/pull/258 in order to fix mod_ssl's
+    failure to load when using OpenSSL 3.  (LP: #1951476)
+
+ -- Sergio Durigan Junior <[e-mail]>  Fri, 26 Nov 2021 16:07:56 -0500
+
+apache2 (2.4.48-3.1ubuntu3) impish; urgency=medium
+
+  * SECURITY REGRESSION: Issues in UDS URIs (LP: #1945311)
+    - debian/patches/CVE-2021-40438-2.patch: Fix UDS unix: scheme for P
+      rules in modules/mappers/mod_rewrite.c.
+    - debian/patches/CVE-2021-40438-3.patch: Handle UDS URIs with empty
+      hostname in modules/mappers/mod_rewrite.c,
+      modules/proxy/proxy_util.c.
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 28 Sep 2021 08:52:26 -0400
+
+apache2 (2.4.48-3.1ubuntu2) impish; urgency=medium
+
+  * SECURITY UPDATE: request splitting over HTTP/2
+    - debian/patches/CVE-2021-33193.patch: refactor request parsing in
+      include/ap_mmn.h, include/http_core.h, include/http_protocol.h,
+      include/http_vhost.h, modules/http2/h2_request.c, server/core.c,
+      server/core_filters.c, server/protocol.c, server/vhost.c.
+    - CVE-2021-33193
+  * SECURITY UPDATE: NULL deref via malformed requests
+    - debian/patches/CVE-2021-34798.patch: add NULL check in
+      server/scoreboard.c.
+    - CVE-2021-34798
+  * SECURITY UPDATE: DoS in mod_proxy_uwsgi
+    - debian/patches/CVE-2021-36160.patch: fix PATH_INFO setting for
+      generic worker in modules/proxy/mod_proxy_uwsgi.c.
+    - CVE-2021-36160
+  * SECURITY UPDATE: buffer overflow in ap_escape_quotes
+    - debian/patches/CVE-2021-39275.patch: fix ap_escape_quotes
+      substitution logic in server/util.c.
+    - CVE-2021-39275
+  * SECURITY UPDATE: arbitrary origin server via crafted request uri-path
+    - debian/patches/CVE-2021-40438-pre1.patch: faster unix socket path
+      parsing in the "proxy:" URL in modules/proxy/mod_proxy.c,
+      modules/proxy/proxy_util.c.
+    - debian/patches/CVE-2021-40438.patch: add sanity checks on the
+      configured UDS path in modules/proxy/proxy_util.c.
+    - CVE-2021-40438
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 23 Sep 2021 12:51:16 -0400
+
+apache2 (2.4.48-3.1ubuntu1) impish; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles. (LP 261198)
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+      (LP 609177)
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
+      d/s/include-binaries: replace Debian with Ubuntu on default
+      page and add Ubuntu icon file.  (LP 1288690)
+    - d/apache2ctl: Also use systemd for graceful if it is in use.
+      This extends an earlier fix for the start command to behave
+      similarly for restart / graceful.  Fixes service failures on
+      unattended upgrade.  (LP 1832182)
+    - d/apache2ctl: Also use /run/systemd to check for systemd usage
+      (LP 1918209)
+
+ -- Bryce Harrington <[e-mail]>  Wed, 11 Aug 2021 20:03:24 -0700
+
+>>>>>>> debian/changelog
 apache2 (2.4.48-3.1) unstable; urgency=medium
 
   * Non-maintainer upload.
@@ -69,6 +197,46 @@ apache2 (2.4.48-3.1) unstable; urgency=medium
 
  -- Thorsten Glaser <[e-mail]>  Sat, 10 Jul 2021 23:31:28 +0200
 
+apache2 (2.4.48-3ubuntu1) impish; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles. (LP: 261198)
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+      (LP: 609177)
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
+      d/s/include-binaries: replace Debian with Ubuntu on default
+      page and add Ubuntu icon file.  (LP: 1288690)
+    - d/apache2ctl: Also use systemd for graceful if it is in use.
+      This extends an earlier fix for the start command to behave
+      similarly for restart / graceful.  Fixes service failures on
+      unattended upgrade.  (LP: 1832182)
+    - d/apache2ctl: Also use /run/systemd to check for systemd usage
+      (LP: 1918209)
+  * Dropped:
+    - d/t/control, d/t/check-http2: add basic test for http2 support
+      [Fixed in 2.4.48-2]
+    - d/p/t/apache/expr_string.t: Avoid test suite failure due to timing
+      [Fixed in 2.4.48-1]
+    - d/p/CVE-2020-13950.patch: don't dereference NULL proxy
+      connection in modules/proxy/mod_proxy_http.c.
+      [Fixed in 2.4.48 upstream]
+    - d/p/CVE-2020-35452.patch: fast validation of the nonce's
+      base64 to fail early if the format can't match anyway in
+      modules/aaa/mod_auth_digest.c.
+      [Fixed in 2.4.48 upstream]
+    - d/p/CVE-2021-26690.patch: save one apr_strtok() in
+      session_identity_decode() in modules/session/mod_session.c.
+      [Fixed in 2.4.48 upstream]
+    - d/p/CVE-2021-26691.patch: account for the '&' in
+      identity_concat() in modules/session/mod_session.c.
+      [Fixed in 2.4.48 upstream]
+    - d/p/CVE-2021-30641.patch: change default behavior in
+      server/request.c.
+      [Fixed in 2.4.48 upstream]
+
+ -- Bryce Harrington <[e-mail]>  Thu, 08 Jul 2021 03:20:46 +0000
+
 apache2 (2.4.48-3) unstable; urgency=medium
 
   * Fix debian/changelog
@@ -125,6 +293,65 @@ apache2 (2.4.46-5) unstable; urgency=medium
 
  -- Yadd <[e-mail]>  Thu, 10 Jun 2021 11:57:38 +0200
 
+apache2 (2.4.46-4ubuntu3) impish; urgency=medium
+
+  * No-change rebuild due to OpenLDAP soname bump.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 21 Jun 2021 17:43:48 -0400
+
+apache2 (2.4.46-4ubuntu2) impish; urgency=medium
+
+  * SECURITY UPDATE: mod_proxy_http denial of service.
+    - debian/patches/CVE-2020-13950.patch: don't dereference NULL proxy
+      connection in modules/proxy/mod_proxy_http.c.
+    - CVE-2020-13950
+  * SECURITY UPDATE: stack overflow via Digest nonce in mod_auth_digest
+    - debian/patches/CVE-2020-35452.patch: fast validation of the nonce's
+      base64 to fail early if the format can't match anyway in
+      modules/aaa/mod_auth_digest.c.
+    - CVE-2020-35452
+  * SECURITY UPDATE: DoS via cookie header in mod_session
+    - debian/patches/CVE-2021-26690.patch: save one apr_strtok() in
+      session_identity_decode() in modules/session/mod_session.c.
+    - CVE-2021-26690
+  * SECURITY UPDATE: heap overflow via SessionHeader
+    - debian/patches/CVE-2021-26691.patch: account for the '&' in
+      identity_concat() in modules/session/mod_session.c.
+    - CVE-2021-26691
+  * SECURITY UPDATE: Unexpected matching behavior with 'MergeSlashes OFF'
+    - debian/patches/CVE-2021-30641.patch: change default behavior in
+      server/request.c.
+    - CVE-2021-30641
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 17 Jun 2021 13:09:41 -0400
+
+apache2 (2.4.46-4ubuntu1) hirsute; urgency=medium
+
+  * Merge with Debian unstable, to allow moving from lua5.2 to
+    lua5.3 (LP: #1910372). Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - d/t/control, d/t/check-http2: add basic test for http2 support
+    - d/p/t/apache/expr_string.t: Avoid test suite failure due to timing
+      issue reading error log too quickly after request, by adding a sleep.
+      (LP #1890302)
+    - d/apache2ctl: Also use systemd for graceful if it is in use.
+      This extends an earlier fix for the start command to behave
+      similarly for restart / graceful.  Fixes service failures on
+      unattended upgrade.
+  * Drop:
+    - d/perl-framework/t/modules/allowmethods.t: disable reset test. This
+      was re-added by mistake in 2.4.41-1 (Closes #921024)
+      [Included in Debian 2.4.46-3]
+  * d/apache2ctl: Also use /run/systemd to check for systemd usage
+    (LP: #1918209)
+
+ -- Bryce Harrington <[e-mail]>  Tue, 09 Mar 2021 00:45:35 +0000
+
 apache2 (2.4.46-4) unstable; urgency=medium
 
   * Ignore other random another test failures (Closes: #979664)
@@ -142,6 +369,28 @@ apache2 (2.4.46-3) unstable; urgency=medium
 
  -- Xavier Guimard <[e-mail]>  Sun, 10 Jan 2021 22:43:21 +0100
 
+apache2 (2.4.46-2ubuntu1) hirsute; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - d/t/control, d/t/check-http2: add basic test for http2 support
+    - d/perl-framework/t/modules/allowmethods.t: disable reset test. This
+      was re-added by mistake in 2.4.41-1 (Closes #921024)
+    - d/p/t/apache/expr_string.t: Avoid test suite failure due to timing
+      issue reading error log too quickly after request, by adding a sleep.
+      (LP #1890302)
+    - d/apache2ctl: Also use systemd for graceful if it is in use.
+      This extends an earlier fix for the start command to behave
+      similarly for restart / graceful.  Fixes service failures on
+      unattended upgrade.
+
+ -- Paride Legovini <[e-mail]>  Mon, 14 Dec 2020 18:12:15 +0100
+
 apache2 (2.4.46-2) unstable; urgency=medium
 
   [ Jean-Michel Vourgère ]
@@ -163,6 +412,39 @@ apache2 (2.4.46-2) unstable; urgency=medium
 
  -- Xavier Guimard <[e-mail]>  Fri, 13 Nov 2020 16:59:01 +0100
 
+apache2 (2.4.46-1ubuntu2) hirsute; urgency=medium
+
+  * d/apache2ctl: Also use systemd for graceful if it is in use.
+    (LP: #1832182)
+    - This extends an earlier fix for the start command to behave
+      similarly for restart / graceful.  Fixes service failures on
+      unattended upgrade.
+
+ -- Bryce Harrington <[e-mail]>  Mon, 05 Oct 2020 16:06:32 -0700
+
+apache2 (2.4.46-1ubuntu1) groovy; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - d/t/control, d/t/check-http2: add basic test for http2 support
+    - d/perl-framework/t/modules/allowmethods.t: disable reset test. This
+      was re-added by mistake in 2.4.41-1 (Closes #921024)
+    - d/p/t/apache/expr_string.t: Avoid test suite failure due to timing
+      issue reading error log too quickly after request, by adding a sleep.
+      (LP #1890302)
+  * Dropped:
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+      [Unclear if it's still necessary, and upstream hasn't made a
+      release with it yet]
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 25 Aug 2020 09:13:38 -0300
+
 apache2 (2.4.46-1) unstable; urgency=medium
 
   [ Xavier Guimard ]
@@ -179,6 +461,39 @@ apache2 (2.4.46-1) unstable; urgency=medium
 
  -- Xavier Guimard <[e-mail]>  Sat, 08 Aug 2020 08:33:36 +0200
 
+apache2 (2.4.43-1ubuntu2) groovy; urgency=medium
+
+  * d/p/t/apache/expr_string.t: Avoid test suite failure due to timing
+    issue reading error log too quickly after request, by adding a sleep.
+    (LP: #1890302)
+
+ -- Bryce Harrington <[e-mail]>  Wed, 05 Aug 2020 12:44:59 -0700
+
+apache2 (2.4.43-1ubuntu1) groovy; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - d/t/control, d/t/check-http2: add basic test for http2 support
+    - d/perl-framework/t/modules/allowmethods.t: disable reset test. This
+      was re-added by mistake in 2.4.41-1 (Closes #921024)
+  * Dropped:
+    - d/p/mod_proxy_ajp-secret-parameter*.patch: add new "secret"
+      parameter to mod_proxy_ajp (LP #1865340)
+      [Fixed upstream]
+    - d/p/buffer-http-request-bodies-for-tlsv13.diff, d/p/tlsv13-add-logno.diff:
+      mod_ssl: Add patches to fix TLS 1.3 client cert authentication for POST requests.
+      Closes #955348, LP #1872478
+      [In 2.4.43-1]
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 21 Jul 2020 10:22:42 -0300
+
 apache2 (2.4.43-1) unstable; urgency=medium
 
   [ Timo Aaltonen ]
@@ -206,6 +521,39 @@ apache2 (2.4.41-5) unstable; urgency=medium
 
  -- Xavier Guimard <[e-mail]>  Wed, 18 Mar 2020 21:06:49 +0100
 
+apache2 (2.4.41-4ubuntu3) focal; urgency=medium
+
+  [ Timo Aaltonen ]
+  * d/p/buffer-http-request-bodies-for-tlsv13.diff, d/p/tlsv13-add-logno.diff:
+    mod_ssl: Add patches to fix TLS 1.3 client cert authentication for POST requests.
+    Closes: #955348, LP: #1872478
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 13 Apr 2020 14:19:17 -0300
+
+apache2 (2.4.41-4ubuntu2) focal; urgency=medium
+
+  * d/p/mod_proxy_ajp-secret-parameter*.patch: add new "secret"
+    parameter to mod_proxy_ajp (LP: #1865340)
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 05 Mar 2020 15:51:00 -0300
+
+apache2 (2.4.41-4ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - d/t/control, d/t/check-http2: add basic test for http2 support
+    - d/perl-framework/t/modules/allowmethods.t: disable reset test. This
+      was re-added by mistake in 2.4.41-1 (Closes #921024)
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 26 Feb 2020 10:36:13 -0300
+
 apache2 (2.4.41-4) unstable; urgency=medium
 
   * Add gcc in chroot autopkgtest (fixes debci)
@@ -230,6 +578,41 @@ apache2 (2.4.41-2) unstable; urgency=medium
 
  -- Xavier Guimard <[e-mail]>  Mon, 13 Jan 2020 06:14:45 +0100
 
+apache2 (2.4.41-1ubuntu1) eoan; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - d/t/control, d/t/check-http2: add basic test for http2 support
+  * Dropped:
+    - Cherrypick upstream testsuite fix:
+      + r1850941 Skip tests for TLSv1.3 (where there is no "renegotiation"
+      as such).
+      + Similarly use TLSv1.2 for pr12355 and pr43738.
+        [Test suite updated in 2.4.41-1]
+    - Cherrypick upstream test suite fix for buffer.
+      [Included in 2.4.41-1]
+    - d/p/spelling-errors.patch: removed hunks already fixed upstream
+      [Included in 2.4.39-1]
+    - Dropped from Ubuntu delta now (removed from Debian since 2.4.39-1):
+      + d/p/CVE-2019-0196.patch
+      + d/p/CVE-2019-0211.patch
+      + d/p/CVE-2019-0215.patch
+      + d/p/CVE-2019-0217.patch
+      + d/p/CVE-2019-0220-*.patch
+      + d/p/CVE-2019-0197.patch
+  * Added:
+    - d/perl-framework/t/modules/allowmethods.t: disable reset test. This
+      was re-added by mistake in 2.4.41-1 (Closes: #921024)
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 14 Aug 2019 11:36:32 -0300
+
 apache2 (2.4.41-1) unstable; urgency=medium
 
   * New upstream version 2.4.41 (Closes: CVE-2019-9517, CVE-2019-10081,
@@ -262,6 +645,62 @@ apache2 (2.4.39-1) unstable; urgency=medium
 
  -- Xavier Guimard <[e-mail]>  Mon, 12 Aug 2019 21:30:33 +0200
 
+apache2 (2.4.39-0ubuntu1) eoan; urgency=medium
+
+  * New upstream version: 2.4.39
+  * d/p/spelling-errors.patch: removed hunks already fixed upstream
+  * Remaining changes:
+    - Cherrypick upstream test suite fix for buffer.
+    - Cherrypick upstream testsuite fix:
+      + r1850941 Skip tests for TLSv1.3 (where there is no "renegotiation"
+      as such).
+    - Similarly use TLSv1.2 for pr12355 and pr43738.
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - d/t/control, d/t/check-http2: add basic test for http2 support
+  * Dropped patches (fixed upstream):
+    - d/p/CVE-2019-0196.patch
+    - d/p/CVE-2019-0211.patch
+    - d/p/CVE-2019-0215.patch
+    - d/p/CVE-2019-0217.patch
+    - d/p/CVE-2019-0220-*.patch
+    - d/p/CVE-2019-0197.patch
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 05 Aug 2019 18:09:08 -0300
+
+apache2 (2.4.38-3ubuntu2) eoan; urgency=medium
+
+  * Cherrypick upstream test suite fix for buffer.
+
+ -- Dimitri John Ledkov <[e-mail]>  Thu, 13 Jun 2019 11:08:24 +0100
+
+apache2 (2.4.38-3ubuntu1) eoan; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Cherrypick upstream testsuite fix:
+      + r1850941 Skip tests for TLSv1.3 (where there is no "renegotiation"
+      as such).
+    - Similarly use TLSv1.2 for pr12355 and pr43738.
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+      [Removed configure chunk, not needed since configure.in is being
+       patched.]
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - d/t/control, d/t/check-http2: add basic test for http2 support
+
+ -- Dimitri John Ledkov <[e-mail]>  Mon, 10 Jun 2019 19:17:38 +0100
+
 apache2 (2.4.38-3) unstable; urgency=high
 
   [ Marc Deslauriers ]
@@ -299,6 +738,79 @@ apache2 (2.4.38-3) unstable; urgency=high
 
  -- Stefan Fritsch <[e-mail]>  Sun, 07 Apr 2019 20:15:40 +0200
 
+apache2 (2.4.38-2ubuntu3) eoan; urgency=medium
+
+  * Cherrypick upstream testsuite fix:
+    - r1850941 Skip tests for TLSv1.3 (where there is no "renegotiation"
+      as such).
+  * Similarly use TLSv1.2 for pr12355 and pr43738.
+
+ -- Dimitri John Ledkov <[e-mail]>  Tue, 07 May 2019 10:39:47 +0100
+
+apache2 (2.4.38-2ubuntu2) disco; urgency=medium
+
+  * SECURITY UPDATE: read-after-free on a string compare in mod_http2
+    - debian/patches/CVE-2019-0196.patch: disentangelment of stream and
+      request method in modules/http2/h2_request.c.
+    - CVE-2019-0196
+  * SECURITY UPDATE: privilege escalation from modules' scripts
+    - debian/patches/CVE-2019-0211.patch: bind the bucket number of each
+      child to its slot number in include/scoreboard.h,
+      server/mpm/event/event.c, server/mpm/prefork/prefork.c,
+      server/mpm/worker/worker.c.
+    - CVE-2019-0211
+  * SECURITY UPDATE: mod_ssl access control bypass
+    - debian/patches/CVE-2019-0215.patch: restore SSL verify state after
+      PHA failure in TLSv1.3 in modules/ssl/ssl_engine_kernel.c.
+    - CVE-2019-0215
+  * SECURITY UPDATE: mod_auth_digest access control bypass
+    - debian/patches/CVE-2019-0217.patch: fix a race condition in
+      modules/aaa/mod_auth_digest.c.
+    - CVE-2019-0217
+  * SECURITY UPDATE: URL normalization inconsistincy
+    - debian/patches/CVE-2019-0220-1.patch: merge consecutive slashes in
+      the path in include/http_core.h, include/httpd.h, server/core.c,
+      server/request.c, server/util.c.
+    - debian/patches/CVE-2019-0220-2.patch: fix r->parsed_uri.path safety
+      in server/request.c, server/util.c.
+    - debian/patches/CVE-2019-0220-3.patch: maintainer mode fix in
+      server/util.c.
+    - CVE-2019-0220
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 03 Apr 2019 14:31:46 -0400
+
+apache2 (2.4.38-2ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+   - debian/patches/086_svn_cross_compiles: Backport several cross
+     fixes from upstream
+     [Removed configure chunk, not needed since configure.in is being
+      patched.]
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - d/t/control, d/t/check-http2: add basic test for http2 support
+  * Dropped:
+    - d/control, d/rules, d/config-dir/mods-available/md.load: don't build
+      libapache2-mod-md, as that makes apache2-bin pull in libcurl4 which
+      cannot be coinstalled with libcurl3. That situation breaks the
+      installation of libapache2-mod-shib2.  See
+      https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1770242/comments/1
+      for details.
+      [This has been resolved in Disco, where libxmltooling8 is built with
+      openssl 1.1]
+    - SECURITY UPDATE: denial of service in HTTP/2 via large SETTINGS frames
+      + debian/patches/CVE-2018-11763.patch: rework connection IO event
+        handling in modules/http2/h2_session.c, modules/http2/h2_session.h,
+        modules/http2/h2_version.h.
+        - CVE-2018-11763
+        [Fixed in 2.4.35]
+
+ -- Andreas Hasenack <[e-mail]>  Sun, 03 Feb 2019 14:57:13 -0200
+
 apache2 (2.4.38-2) unstable; urgency=medium
 
   * Disable "reset" test in allowmethods.t (Closes: #921024)
@@ -381,6 +893,37 @@ apache2 (2.4.35-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 07 Oct 2018 12:54:58 +0200
 
+apache2 (2.4.34-1ubuntu2) cosmic; urgency=medium
+
+  * SECURITY UPDATE: denial of service in HTTP/2 via large SETTINGS frames
+    - debian/patches/CVE-2018-11763.patch: rework connection IO event
+      handling in modules/http2/h2_session.c, modules/http2/h2_session.h,
+      modules/http2/h2_version.h.
+    - CVE-2018-11763
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 03 Oct 2018 09:57:22 -0400
+
+apache2 (2.4.34-1ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - d/t/control, d/t/check-http2: add basic test for http2 support
+    - d/control, d/rules, d/config-dir/mods-available/md.load: don't build
+      libapache2-mod-md, as that makes apache2-bin pull in libcurl4 which
+      cannot be coinstalled with libcurl3. That situation breaks the
+      installation of libapache2-mod-shib2.  See
+      https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1770242/comments/1
+      for details.
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 03 Aug 2018 17:09:27 -0300
+
 apache2 (2.4.34-1) unstable; urgency=medium
 
   [ Ondřej Surý ]
@@ -399,6 +942,87 @@ apache2 (2.4.34-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Fri, 27 Jul 2018 21:37:37 +0200
 
+apache2 (2.4.33-3ubuntu3) cosmic; urgency=medium
+
+  * d/control, d/rules, d/config-dir/mods-available/proxy_uwsgi.load:
+    re-enable proxy_uwsgi, as the uwsgi source no longer builds this module.
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 28 Jun 2018 10:07:06 -0300
+
+apache2 (2.4.33-3ubuntu2) cosmic; urgency=medium
+
+  * d/control, d/rules: Don't build libapache2-mod-proxy-uwsgi and
+    libapache2-mod-md until we figure out their transitions.  libapache2-mod-md
+    in particular is problematic because that makes apache2-bin pull in
+    libcurl4 which cannot be coinstalled with libcurl3.  That situation breaks
+    the installation of libapache2-mod-shib2.  See
+    https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1770242/comments/1
+    for details.
+    - Don't ship md.load and remove build-requires that were added because of
+      mod-md (see
+      https://salsa.debian.org/apache-team/apache2/commit/b9d37f2a96da2fd69bf)
+    - Remove proxy_uwsgi.load as we are not building it for now (see
+      https://salsa.debian.org/apache-team/apache2/commit/4e3168562d75ce398b9)
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 17 May 2018 14:46:19 +0000
+
+apache2 (2.4.33-3ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1770242). Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - d/t/control, d/t/check-http2: add basic test for http2 support
+  * Drop:
+    - SECURITY UPDATE: DoS via missing header with AuthLDAPCharsetConfig
+      + debian/patches/CVE-2017-15710.patch: fix language long names
+        detection as short name in modules/aaa/mod_authnz_ldap.c.
+      + CVE-2017-15710
+    - SECURITY UPDATE: incorrect <FilesMatch> matching
+      + debian/patches/CVE-2017-15715.patch: allow to configure
+        global/default options for regexes, like caseless matching or
+        extended format in include/ap_regex.h, server/core.c,
+        server/util_pcre.c.
+      + CVE-2017-15715
+    - SECURITY UPDATE: mod_session header manipulation
+      + debian/patches/CVE-2018-1283.patch: strip Session header when
+        SessionEnv is on in modules/session/mod_session.c.
+      + CVE-2018-1283
+    - SECURITY UPDATE: DoS via specially-crafted request
+      + debian/patches/CVE-2018-1301.patch: ensure that read lines are NUL
+        terminated on any error, not only on buffer full in
+        server/protocol.c.
+      + CVE-2018-1301
+    - SECURITY UPDATE: mod_cache_socache DoS
+      + debian/patches/CVE-2018-1303.patch: fix caching of empty headers up
+        to carriage return in modules/cache/mod_cache_socache.c.
+      + CVE-2018-1303
+    - SECURITY UPDATE: insecure nonce generation
+      + debian/patches/CVE-2018-1312.patch: actually use the secret when
+        generating nonces in modules/aaa/mod_auth_digest.c.
+      + CVE-2018-1312
+    - Correct systemd-sysv-generator behavior by customizing some
+      parameters:
+      + d/apache2-systemd.conf: add a drop-in file to specify some
+        parameters for the systemd unit (type=Forking and
+        RemainsAfterExit=no), this allow a correct state synchronisation
+        between systemctl status and actual state of apache2 daemon.
+      + d/apache2.install: place the apache2-systemd.conf file in the
+        correct location.
+      [type=Forking already in the base systemd service file, and
+       RemainsAfterExit=no is the default value, so no need to
+       customize these anymore.]
+    - Avoid crashes, hangs and loops by fixing mod_ldap locking: (LP #1752683)
+      + added debian/patches/util_ldap_cache_lock_fix.patch
+      [Already applied upstream]
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 15 May 2018 11:03:34 -0300
+
 apache2 (2.4.33-3) unstable; urgency=medium
 
   * Add Breaks for libapache2-mod-proxy-uwsgi and libapache2-mod-md, too.
@@ -471,6 +1095,91 @@ apache2 (2.4.29-2) unstable; urgency=medium
 
  -- Ondřej Surý <[e-mail]>  Sun, 14 Jan 2018 11:01:58 +0000
 
+apache2 (2.4.29-1ubuntu4.1) bionic-security; urgency=medium
+
+  * SECURITY UPDATE: DoS via missing header with AuthLDAPCharsetConfig
+    - debian/patches/CVE-2017-15710.patch: fix language long names
+      detection as short name in modules/aaa/mod_authnz_ldap.c.
+    - CVE-2017-15710
+  * SECURITY UPDATE: incorrect <FilesMatch> matching
+    - debian/patches/CVE-2017-15715.patch: allow to configure
+      global/default options for regexes, like caseless matching or
+      extended format in include/ap_regex.h, server/core.c,
+      server/util_pcre.c.
+    - CVE-2017-15715
+  * SECURITY UPDATE: mod_session header manipulation
+    - debian/patches/CVE-2018-1283.patch: strip Session header when
+      SessionEnv is on in modules/session/mod_session.c.
+    - CVE-2018-1283
+  * SECURITY UPDATE: DoS via specially-crafted request
+    - debian/patches/CVE-2018-1301.patch: ensure that read lines are NUL
+      terminated on any error, not only on buffer full in
+      server/protocol.c.
+    - CVE-2018-1301
+  * SECURITY UPDATE: mod_cache_socache DoS
+    - debian/patches/CVE-2018-1303.patch: fix caching of empty headers up
+      to carriage return in modules/cache/mod_cache_socache.c.
+    - CVE-2018-1303
+  * SECURITY UPDATE: insecure nonce generation
+    - debian/patches/CVE-2018-1312.patch: actually use the secret when
+      generating nonces in modules/aaa/mod_auth_digest.c.
+    - CVE-2018-1312
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 25 Apr 2018 07:38:24 -0400
+
+apache2 (2.4.29-1ubuntu4) bionic; urgency=medium
+
+  * Avoid crashes, hangs and loops by fixing mod_ldap locking: (LP: #1752683)
+    - added debian/patches/util_ldap_cache_lock_fix.patch
+
+ -- Rafael David Tinoco <[e-mail]>  Fri, 02 Mar 2018 02:19:31 +0000
+
+apache2 (2.4.29-1ubuntu3) bionic; urgency=medium
+
+  * Switch back to OpenSSL 1.1.
+
+ -- Dimitri John Ledkov <[e-mail]>  Tue, 06 Feb 2018 11:57:20 +0000
+
+apache2 (2.4.29-1ubuntu2) bionic; urgency=medium
+
+  * enable http2 (LP: #1687454) by stopping to disable it
+    - debian/control: no more removed libnghttp2-dev Build-Depends (in universe).
+    - debian/config-dir/mods-available/http2.load: no more removed.
+    - debian/rules: no more removed proxy_http2 from configure.
+  * d/t/control, d/t/check-http2: add basic test for http2 support
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 05 Dec 2017 17:25:39 +0100
+
+apache2 (2.4.29-1ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - Correct systemd-sysv-generator behavior by customizing some
+      parameters:
+      + d/apache2-systemd.conf: add a drop-in file to specify some
+        parameters for the systemd unit (type=Forking and
+        RemainsAfterExit=no), this allow a correct state synchronisation
+        between systemctl status and actual state of apache2 daemon.
+      + d/apache2.install: place the apache2-systemd.conf file in the
+        correct location.
+    - Don't build http2 module (nghttp2 still not in main) (LP 1687454)
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+      + debian/rules: removed proxy_http2 from configure.
+  * Switch back to OpenSSL 1.0 as we don't yet have 1.1:
+    - debian/control: switch BuildDepends to libssl1.0-dev
+    - debian/control: remove Breaks on gridsite and libapache2-mod-dacs
+    - debian/rules: remove openssl virtual package and logic
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 10 Nov 2017 10:51:46 -0500
+
 apache2 (2.4.29-1) unstable; urgency=medium
 
   [ Stefan Fritsch ]
@@ -535,6 +1244,47 @@ apache2 (2.4.27-3) experimental; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 16 Jul 2017 23:11:07 +0200
 
+apache2 (2.4.27-2ubuntu3) artful; urgency=medium
+
+  * SECURITY UPDATE: optionsbleed information leak
+    - debian/patches/CVE-2017-9798.patch: disallow method registration
+      at run time in server/core.c.
+    - CVE-2017-9798
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 18 Sep 2017 11:05:48 -0400
+
+apache2 (2.4.27-2ubuntu2) artful; urgency=medium
+
+  * Undrop (LP 1658469):
+    - Don't build http2 module (nghttp2 still not in main) (LP 1687454)
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+      + debian/rules: removed proxy_http2 from configure.
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 02 Aug 2017 13:04:45 -0400
+
+apache2 (2.4.27-2ubuntu1) artful; urgency=medium
+
+  * Merge with Debian unstable (LP: #1702582). Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - Correct systemd-sysv-generator behavior by customizing some
+      parameters:
+      + d/apache2-systemd.conf: add a drop-in file to specify some
+        parameters for the systemd unit (type=Forking and
+        RemainsAfterExit=no), this allow a correct state synchronisation
+        between systemctl status and actual state of apache2 daemon.
+      + d/apache2.install: place the apache2-systemd.conf file in the
+        correct location.
+
+ -- Nishanth Aravamudan <[e-mail]>  Thu, 27 Jul 2017 13:38:39 -0700
+
 apache2 (2.4.27-2) unstable; urgency=medium
 
   * Switch back to openssl 1.0 for now. The transition to 1.1 needs more
@@ -564,6 +1314,55 @@ apache2 (2.4.25-4) unstable; urgency=high
 
  -- Stefan Fritsch <[e-mail]>  Tue, 20 Jun 2017 21:31:51 +0200
 
+apache2 (2.4.25-3ubuntu3) artful; urgency=medium
+
+  * Re-Drop (LP: #1658469):
+    - Don't build experimental http2 module for LTS:
+     + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+     + debian/config-dir/mods-available/http2.load: removed.
+     + debian/rules: removed proxy_http2 from configure.
+     + debian/apache2.maintscript: remove http2 conffile.
+
+ -- Nishanth Aravamudan <[e-mail]>  Mon, 01 May 2017 09:55:11 -0700
+
+apache2 (2.4.25-3ubuntu2) zesty; urgency=medium
+  * Undrop (LP 1658469):
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+      + debian/rules: removed proxy_http2 from configure.
+      + debian/apache2.maintscript: remove http2 conffile.
+
+ -- Nishanth Aravamudan <[e-mail]>  Fri, 10 Feb 2017 08:53:43 -0800
+
+apache2 (2.4.25-3ubuntu1) zesty; urgency=medium
+
+  * Merge from Debian unstable (LP: #1663425). Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - Correct systemd-sysv-generator behavior by customizing some
+      parameters:
+      + d/apache2-systemd.conf: add a drop-in file to specify some
+        parameters for the systemd unit (type=Forking and
+        RemainsAfterExit=no), this allow a correct state synchronisation
+        between systemctl status and actual state of apache2 daemon.
+      + d/apache2.install: place the apache2-systemd.conf file in the
+        correct location.
+   * Drop (LP: #1658469):
+     - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+      + debian/rules: removed proxy_http2 from configure.
+      + debian/apache2.maintscript: remove http2 conffile.
+
+ -- Nishanth Aravamudan <[e-mail]>  Thu, 09 Feb 2017 15:48:28 -0800
+
 apache2 (2.4.25-3) unstable; urgency=medium
 
   * Fix detection of systemd to fix 'apache2ctl start' on sysv-init.
@@ -625,6 +1424,39 @@ apache2 (2.4.25-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Wed, 21 Dec 2016 23:46:06 +0100
 
+apache2 (2.4.23-8ubuntu1) zesty; urgency=medium
+
+  * Merge from Debian unstable (LP: #). Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
+      d/source/include-binaries: replace Debian with Ubuntu on default
+      page.
+      [ include-binaries change previously undocumented ]
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+      + debian/rules: removed proxy_http2 from configure.
+      + debian/apache2.maintscript: remove http2 conffile.
+        [ Previously undocumented ]
+    - Correct systemd-sysv-generator behavior by customizing some
+      parameters:
+      + d/apache2-systemd.conf: add a drop-in file to specify some
+        parameters for the systemd unit (type=Forking and
+        RemainsAfterExit=no), this allow a correct state synchronisation
+        between systemctl status and actual state of apache2 daemon.
+      + d/apache2.install: place the apache2-systemd.conf file in the
+        correct location.
+  * Drop:
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    [ Incorrectly indicated as delta, fixed by Debian in 2.4.18-2 ]
+
+ -- Nishanth Aravamudan <[e-mail]>  Fri, 09 Dec 2016 11:02:38 +0100
+
 apache2 (2.4.23-8) unstable; urgency=medium
 
   * Move the mod_ssl_openssl.h header and the dependency on libssl-dev to a
@@ -635,6 +1467,33 @@ apache2 (2.4.23-8) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 20 Nov 2016 00:33:13 +0100
 
+apache2 (2.4.23-7ubuntu1) zesty; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+      + debian/rules: removed proxy_http2 from configure.
+    - Correct systemd-sysv-generator behavior by customizing some
+      parameters:
+      + d/apache2-systemd.conf: add a drop-in file to specify some
+        parameters for the systemd unit (type=Forking and
+        RemainsAfterExit=no), this allow a correct state synchronisation
+        between systemctl status and actual state of apache2 daemon.
+      + d/apache2.install: place the apache2-systemd.conf file in the
+        correct location.
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 16 Nov 2016 09:17:24 -0500
+
 apache2 (2.4.23-7) unstable; urgency=medium
 
   * Make apache2-dev depend on openssl 1.0, too. Closes: #844160
@@ -749,6 +1608,55 @@ apache2 (2.4.20-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 10 Apr 2016 14:03:41 +0200
 
+apache2 (2.4.18-2ubuntu4) yakkety; urgency=medium
+
+  * SECURITY UPDATE: proxy request header vulnerability (httpoxy)
+    - debian/patches/CVE-2016-5387.patch: don't pass through HTTP_PROXY in
+      server/util_script.c.
+    - CVE-2016-5387
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 18 Jul 2016 14:32:02 -0400
+
+apache2 (2.4.18-2ubuntu3) xenial; urgency=medium
+
+  [ Ryan Harper ]
+  * Drop /etc/apache2/mods-available/http2.load. This was inadvertently
+    introduced in 2.4.18-2ubuntu1. The intention is to not carry this at
+    all, since http2 support is intentionally disabled (see LP 1531864).
+  * d/apache2.maintscript: handle removal of http2.load conffile.
+
+  [ Robie Basak ]
+  * Re-write Ryan's changelog entry.
+
+ -- Robie Basak <[e-mail]>  Fri, 15 Apr 2016 18:00:57 +0000
+
+apache2 (2.4.18-2ubuntu2) xenial; urgency=medium
+
+  * Correct systemd-sysv-generator behavior by customizing some parameters (LP: #1488962)
+    - d/apache2-systemd.conf: add a drop-in file to specify some parameters for the systemd
+      unit (type=Forking and RemainsAfterExit=no), this allow a correct state synchronisation
+      between systemctl status and actual state of apache2 daemon.
+    - d/apache2.install: place the apache2-systemd.conf file in the correct location.
+
+ -- Pierre-André MOREY <[e-mail]>  Fri, 08 Apr 2016 11:48:00 +0200
+
+apache2 (2.4.18-2ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+
+ -- Timo Aaltonen <[e-mail]>  Wed, 06 Apr 2016 00:18:31 +0300
+
 apache2 (2.4.18-2) unstable; urgency=low
 
   * htcacheclean:
@@ -774,6 +1682,24 @@ apache2 (2.4.18-2) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Mon, 28 Mar 2016 21:58:54 +0200
 
+apache2 (2.4.18-1ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 21 Jan 2016 15:15:22 -0500
+
 apache2 (2.4.18-1) unstable; urgency=medium
 
   * New upstream release:
@@ -781,12 +1707,48 @@ apache2 (2.4.18-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sat, 19 Dec 2015 09:26:14 +0100
 
+apache2 (2.4.17-3ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 03 Dec 2015 10:07:35 -0500
+
 apache2 (2.4.17-3) unstable; urgency=medium
 
   * mpm_prefork: Fix segfault if started with -X. Closes: #805737
 
  -- Stefan Fritsch <[e-mail]>  Mon, 23 Nov 2015 19:52:09 +0100
 
+apache2 (2.4.17-2ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 20 Nov 2015 09:11:52 -0500
+
 apache2 (2.4.17-2) unstable; urgency=medium
 
   * Revert REDIRECT_URL to pre-2.4.17 behavior for now. The change broke
@@ -797,6 +1759,31 @@ apache2 (2.4.17-2) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sat, 31 Oct 2015 23:17:11 +0100
 
+apache2 (2.4.17-1ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+  * Drop patches (applied upstream):
+    - debian/patches/CVE-2015-3183.patch
+    - debian/patches/CVE-2015-3185.patch
+  * Drop changes (adopted in Debian):
+    - Allow "triggers-awaited" and "triggers-pending" states in addition
+      to "installed" when determining whether to defer actions or
+      process deferred actions.
+  * Don't build experimental http2 module for LTS
+    - debian/control: removed libnghttp2-dev Build-Depends (in universe).
+    - debian/config-dir/mods-available/http2.load: removed.
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 30 Oct 2015 09:35:46 -0400
+
 apache2 (2.4.17-1) unstable; urgency=medium
 
   [ Stefan Fritsch ]
@@ -862,6 +1849,49 @@ apache2 (2.4.16-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 02 Aug 2015 00:44:07 +0200
 
+apache2 (2.4.12-2ubuntu2) wily; urgency=medium
+
+  * SECURITY UPDATE: request smuggling via chunked transfer encoding
+    - debian/patches/CVE-2015-3183.patch: refactor chunk parsing in
+      modules/http/http_filters.c.
+    - CVE-2015-3183
+  * SECURITY UPDATE: access restriction bypass via deprecated API
+    - debian/patches/CVE-2015-3185.patch: deprecate old API and add new one
+      in include/http_request.h, server/request.c.
+    - CVE-2015-3185
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 24 Jul 2015 09:56:09 -0400
+
+apache2 (2.4.12-2ubuntu1) wily; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - Allow "triggers-awaited" and "triggers-pending" states in addition
+      to "installed" when determining whether to defer actions or
+      process deferred actions.
+  * Drop patches (applied upstream):
+    - d/p/split-logfile.patch
+    - d/p/CVE-2015-0228.patch
+  * Drop changes (superceded in Debian):
+    - Cherry-pick versioned build-depend on dpkg from Debian for correct
+      dpkg-maintscript-helper symlink_to_dir support.
+  * Drop changes (adopted in Debian):
+    - d/control, d/config-dir/mods-available/ssl.conf,
+      d/ask-for-passphrase, d/apache2.install: Plymouth aware passphrase
+      dialog program ask-for-passphrase.
+  * Fix cross-building configure line in d/rules, which had bit-rotted in
+    previous merges.
+
+ -- Robie Basak <[e-mail]>  Thu, 28 May 2015 16:34:00 +0000
+
 apache2 (2.4.12-2) unstable; urgency=medium
 
   [ Jean-Michel Nirgal Vourgère ]
@@ -911,6 +1941,28 @@ apache2 (2.4.10-10) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 15 Mar 2015 10:47:36 +0100
 
+apache2 (2.4.10-9ubuntu1) vivid; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf,
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - d/p/split-logfile.patch: fix completely broken split-logfile
+      command.
+    - d/p/CVE-2015-0228.patch: fix logic in modules/lua/lua_request.c to fix a
+      denial of service in mod_lua via websockets PING
+  * debian/tests/ssl-passphrase: Add password responder for
+    systemd-ask-passphrase.
+
+ -- Martin Pitt <[e-mail]>  Mon, 09 Mar 2015 12:03:16 +0100
+
 apache2 (2.4.10-9) unstable; urgency=medium
 
   * CVE-2014-8109: mod_lua: Fix handling of the Require line when a
@@ -925,6 +1977,54 @@ apache2 (2.4.10-9) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Mon, 22 Dec 2014 20:24:36 +0100
 
+apache2 (2.4.10-8ubuntu3) vivid; urgency=medium
+
+  * SECURITY UPDATE: restriction bypass in mod_lua via multiple Require
+    directives
+    - debian/patches/CVE-2014-8109.patch: handle multiple Require
+      directives with different arguments in modules/lua/mod_lua.c.
+    - CVE-2014-8109
+  * SECURITY UPDATE: denial of service in mod_lua via websockets PING
+    - debian/patches/CVE-2015-0228.patch: fix logic in
+      modules/lua/lua_request.c.
+    - CVE-2015-0228
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 05 Mar 2015 10:56:34 -0500
+
+apache2 (2.4.10-8ubuntu2) vivid; urgency=medium
+
+  * Allow "triggers-awaited" and "triggers-pending" states in addition to
+    "installed" when determining whether to defer actions or process
+    deferred actions (LP: #1393832).
+
+ -- Colin Watson <[e-mail]>  Wed, 26 Nov 2014 11:31:44 +0000
+
+apache2 (2.4.10-8ubuntu1) vivid; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf,
+      d/ask-for-passphrase, d/apache2.install: Plymouth aware passphrase
+      dialog program ask-for-passphrase.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - d/p/split-logfile.patch: fix completely broken split-logfile
+      command.
+  * Fixes from Debian included in merge:
+    - Crash caused by OCSP stapling code; this was erroneously
+      attributed to Debian in my previous merge, but actually only
+      appears in 2.4.10-8; with thanks to Stefan Fritsch (LP: #1366174).
+  * Cherry-pick versioned build-depend on dpkg from Debian for correct
+    dpkg-maintscript-helper symlink_to_dir support.
+
+ -- Robie Basak <[e-mail]>  Fri, 21 Nov 2014 15:15:58 +0000
+
 apache2 (2.4.10-8) unstable; urgency=medium
 
   * Bump dpkg Pre-Depends to version that supports relative symlinks in
@@ -939,6 +2039,33 @@ apache2 (2.4.10-8) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Tue, 18 Nov 2014 15:18:18 +0100
 
+apache2 (2.4.10-7ubuntu1) vivid; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf,
+      d/ask-for-passphrase, d/apache2.install: Plymouth aware passphrase
+      dialog program ask-for-passphrase.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - d/p/split-logfile.patch: fix completely broken split-logfile command.
+  * Fixes from Debian included in merge:
+    - Don't use a2query in preinst, as it may not be available yet
+      (LP: #1312533).
+    - Crash caused by OCSP stapling code (LP: #1366174).
+    - Disable SSLv3 in default config (LP: #1358305).
+    - If apache2 is not configured yet, defer actions executed via
+      apache2-maintscript-helper. This fixes installation failures if a
+      module package is configured first (LP: #1312854).
+
+ -- Robie Basak <[e-mail]>  Mon, 17 Nov 2014 18:04:40 +0000
+
 apache2 (2.4.10-7) unstable; urgency=medium
 
   * Handle transitions of doc dirs and symlinks correctly during upgrade.
@@ -1022,6 +2149,25 @@ apache2 (2.4.10-2) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 21 Sep 2014 22:58:33 +0200
 
+apache2 (2.4.10-1ubuntu1) utopic; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf, d/ask-for-passphrase,
+      d/apache2.install: Plymouth aware passphrase dialog program
+      ask-for-passphrase.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE to
+      configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross fixes from
+      upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - d/p/split-logfile.patch: fix completely broken split-logfile command.
+
+ -- Robie Basak <[e-mail]>  Thu, 24 Jul 2014 15:13:16 +0000
+
 apache2 (2.4.10-1) unstable; urgency=medium
 
   [ Arno Töll ]
@@ -1069,6 +2215,45 @@ apache2 (2.4.9-2) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 08 Jun 2014 10:38:04 +0200
 
+apache2 (2.4.9-1ubuntu2) utopic; urgency=medium
+
+  * Revert 2.4.4-6ubuntu3 and build against lua 5.1 again, since Apache doesn't
+    yet support building against lua 5.2 (LP: #1323930).
+
+ -- Robie Basak <[e-mail]>  Wed, 28 May 2014 08:55:25 +0000
+
+apache2 (2.4.9-1ubuntu1) utopic; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf, d/ask-for-passphrase,
+      d/apache2.install, d/tests/ssl-passphrase: Plymouth aware passphrase
+      dialog program ask-for-passphrase.
+    - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE to
+      configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross fixes from
+      upstream
+    - Build using lua5.2.
+    - d/tests/chroot: dep8 test for ChrootDir case.
+    - d/tests/ssl-passphrase: update for new default path /var/www/html.
+    - d/tests/duplicate-module-load: check for duplicate module loads.
+    - d/index.html: replace Debian with Ubuntu on default page (LP: #1288690).
+    - d/p/split-logfile.patch: fix completely broken split-logfile command
+      (LP: #1299162). Thanks to Holger Mauermann.
+  * Drop changes (upstreamed):
+    - d/p/ignore-quilt-dir: adjust build system so that it does not use
+      files find inside the .pc directory. This stops a double module load
+      causing later havoc, including "ChrootDir" directive failure.
+    - debian/patches/CVE-2013-6438.patch: properly calculate correct length
+      in modules/dav/main/util.c.
+    - debian/patches/CVE-2014-0098.patch: properly parse tokens in
+      modules/loggers/mod_log_config.c.
+  * d/tests/control: adjust dep8 tests for new "breaks-testbed" facility.
+
+ -- Robie Basak <[e-mail]>  Fri, 09 May 2014 19:30:04 +0000
+
 apache2 (2.4.9-1) unstable; urgency=medium
 
   * New upstream version.
@@ -1101,6 +2286,63 @@ apache2 (2.4.9-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sat, 29 Mar 2014 22:50:32 +0100
 
+apache2 (2.4.7-1ubuntu4) trusty; urgency=medium
+
+  * d/p/split-logfile.patch: fix completely broken split-logfile command
+    (LP: #1299162). Thanks to Holger Mauermann.
+
+ -- Robie Basak <[e-mail]>  Thu, 03 Apr 2014 11:21:22 +0000
+
+apache2 (2.4.7-1ubuntu3) trusty; urgency=medium
+
+  * SECURITY UPDATE: denial of service via mod_dav incorrect end of string
+    calculation
+    - debian/patches/CVE-2013-6438.patch: properly calculate correct length
+      in modules/dav/main/util.c.
+    - CVE-2013-6438
+  * SECURITY UPDATE: denial of service via truncated cookie and
+    mod_log_config
+    - debian/patches/CVE-2014-0098.patch: properly parse tokens in
+      modules/loggers/mod_log_config.c.
+    - CVE-2014-0098
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 20 Mar 2014 08:34:10 -0400
+
+apache2 (2.4.7-1ubuntu2) trusty; urgency=medium
+
+  * d/index.html: replace Debian with Ubuntu on default page
+    (LP: #1288690).
+
+ -- Robie Basak <[e-mail]>  Wed, 19 Mar 2014 11:04:21 +0000
+
+apache2 (2.4.7-1ubuntu1) trusty; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf,
+      d/ask-for-passphrase, d/apache2.install, d/tests/ssl-passphrase:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+    - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE
+      to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross fixes
+      from upstream
+    - Build using lua5.2.
+    - d/tests/chroot: dep8 test for ChrootDir case.
+    - d/p/ignore-quilt-dir: adjust build system so that it does not use
+      files find inside the .pc directory. This stops a double module load
+      causing later havoc, including "ChrootDir" directive failure.
+  * Drop changes:
+    - debian/{control, rules}: Enable PIE hardening: no longer required;
+      2.4.7-1 is already hardened.
+    - d/p/itk-rerun-configure.patch: no longer needed, as ITK support has moved
+      out of this package.
+  * d/tests/ssl-passphrase: update for new default path /var/www/html.
+  * d/tests/duplicate-module-load: check for duplicate module loads.
+
+ -- Robie Basak <[e-mail]>  Tue, 14 Jan 2014 17:23:47 +0000
+
 apache2 (2.4.7-1) unstable; urgency=low
 
   New upstream version
@@ -1164,6 +2406,53 @@ apache2 (2.4.6-3) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Mon, 12 Aug 2013 20:15:38 +0200
 
+apache2 (2.4.6-2ubuntu4) trusty; urgency=low
+
+  * d/p/ignore-quilt-dir, d/p/itk-rerun-configure.patch: adjust build system so
+    that it does not use files find inside the .pc directory. This stops a
+    double module load causing later havoc, including "ChrootDir" directive
+    failure (LP: #1251939). Thanks to Stefan Fritsch.
+  * d/tests/chroot: dep8 test for ChrootDir case.
+
+ -- Robie Basak <[e-mail]>  Thu, 28 Nov 2013 16:21:51 +0000
+
+apache2 (2.4.6-2ubuntu3) trusty; urgency=low
+
+  * debian/apache2.install: Correct path for ufw.
+    (LP: #1252722) 
+
+ -- Chuck Short <[e-mail]>  Tue, 19 Nov 2013 08:59:54 -0500
+
+apache2 (2.4.6-2ubuntu2) saucy; urgency=low
+
+  * d/ask-for-passphrase: mark executable so that apache2 can run it. Fixes
+    passphrase prompting for SSL certificates that are passphrase protected.
+  * Add dep8 test for SSL passphrase prompting.
+
+ -- Robie Basak <[e-mail]>  Fri, 09 Aug 2013 13:08:52 +0000
+
+apache2 (2.4.6-2ubuntu1) saucy; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/control, debian/config-dir/mods-available/ssl.conf,
+      debian/ask-for-passphrase, debian/apache2.install: Plymouth aware
+      passphrase dialog program ask-for-passphrase.
+    - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE
+      to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross fixes
+      from upstream
+  * Dropped changes:
+    - debian/patches/CVE-2013-1896.patch: upstream
+  * Fixed module dependencies (LP: #1205314)
+    - debian/config-dir/mods-available/lbmethod_*: properly specify
+      proxy_balancer, not mod_proxy_balancer.
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 26 Jul 2013 08:31:33 -0400
+
 apache2 (2.4.6-2) unstable; urgency=low
 
   [ Stefan Fritsch ]
@@ -1216,6 +2505,56 @@ apache2 (2.4.6-1) unstable; urgency=low
 
  -- Arno Töll <[e-mail]>  Sun, 21 Jul 2013 18:44:42 +0200
 
+apache2 (2.4.4-6ubuntu5) saucy; urgency=low
+
+  * SECURITY UPDATE: denial of service via MERGE request
+    - debian/patches/CVE-2013-1896.patch: make sure DAV is enabled for URI
+      in modules/dav/main/mod_dav.c.
+    - CVE-2013-1896
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 18 Jul 2013 11:20:47 -0400
+
+apache2 (2.4.4-6ubuntu4) saucy; urgency=low
+
+  * d/apache2-{utils,bin}.install: move apport hook from apache2-utils to
+    apache2-bin. apache2-utils is only suggested by apache2, so may not
+    always be installed by bug reporters. However, apache2-bin will always
+    need to be installed for Apache to be functional, so this is a better
+    place for the apport hook. apache2-bin already Conflicts/Replaces
+    apache2.2-common, so this also fixes (LP: #1199318).
+  * d/apache2.py: adjust apport hook for new location of configuration
+    files in apache2 >= 2.4: they have moved from apache2.2-common to
+    apache2.
+
+ -- Robie Basak <[e-mail]>  Wed, 17 Jul 2013 17:54:22 +0000
+
+apache2 (2.4.4-6ubuntu3) saucy; urgency=low
+
+  * Build using lua5.2.
+
+ -- Matthias Klose <[e-mail]>  Wed, 17 Jul 2013 14:24:42 +0200
+
+apache2 (2.4.4-6ubuntu2) saucy; urgency=low
+
+  * debian/rules: Fix FTBFS while installing ufw. 
+
+ -- Chuck Short <[e-mail]>  Tue, 02 Jul 2013 10:10:14 -0500
+
+apache2 (2.4.4-6ubuntu1) saucy; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+  * Dropped changes:
+    - debian/patches/CVE-2012-2687.patch: Dropped no longer needed.
+    - debian/patches/CVE-2012-3499_4558.patch: Dropped no longer needed.
+    - debian/patches/CVE-2012-4929.patch: Dropped no longer needed.
+
+ -- Chuck Short <[e-mail]>  Tue, 02 Jul 2013 08:34:01 -0500
+
 apache2 (2.4.4-6) unstable; urgency=low
 
   * Denote exact versions breaking gnome-user-share now that Gnome maintainers
@@ -1687,6 +3026,122 @@ apache2 (2.4.1-1) experimental; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Mon, 19 Mar 2012 10:46:02 +0100
 
+apache2 (2.2.22-6ubuntu5) raring; urgency=low
+
+  * SECURITY UPDATE: multiple cross-site scripting issues
+    - debian/patches/CVE-2012-3499_4558.patch: properly escape html in
+      modules/generators/{mod_info.c,mod_status.c},
+      modules/ldap/util_ldap_cache_mgr.c, modules/mappers/mod_imagemap.c,
+      modules/proxy/{mod_proxy_balancer.c,mod_proxy_ftp.c}.
+    - CVE-2012-3499
+    - CVE-2012-4558
+  * SECURITY UPDATE: symlink attack in apache2ctl script
+    - debian/apache2ctl: introduce and use a safer mkdir_chown() function.
+    - Thanks to Stefan Fritsch for the fix.
+    - CVE-2013-1048
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 15 Mar 2013 07:59:58 -0400
+
+apache2 (2.2.22-6ubuntu4) raring; urgency=low
+
+  * Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE to configure.
+  * Skip module sanity check between MPMs if cross-building without the
+    kernel/binfmt support to run our target binaries on the build system.
+  * Backport several cross fixes from upstream as 086_svn_cross_compiles.
+
+ -- Adam Conrad <[e-mail]>  Wed, 05 Dec 2012 02:21:46 -0700
+
+apache2 (2.2.22-6ubuntu3) raring; urgency=low
+
+  * SECURITY UPDATE: XSS vulnerability in mod_negotiation
+    - debian/patches/CVE-2012-2687.patch: escape filenames in
+      modules/mappers/mod_negotiation.c.
+    - CVE-2012-2687
+  * SECURITY UPDATE: CRIME attack ssl attack (LP: #1068854)
+    - debian/patches/CVE-2012-4929.patch: backport SSLCompression on|off
+      directive. Defaults to off as enabling compression enables the CRIME
+      attack.
+    - CVE-2012-4929
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 08 Nov 2012 17:56:24 -0500
+
+apache2 (2.2.22-6ubuntu2) quantal; urgency=low
+
+  * debian/apache2.py
+   - Update apport hook for python3 ; thanks to Edward Donovan (LP: #1013171)
+   - Check if this directory exists: /etc/apache2/sites-enabled/
+
+ -- Matthieu Baerts (matttbe) <[e-mail]>  Mon, 16 Jul 2012 10:02:18 +0200
+
+apache2 (2.2.22-6ubuntu1) quantal; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+  * Dropped changes:
+    - debian/control: Add bzr tag and point it to our tree; this is not 
+      really required and just increases the delta.
+
+ -- Robie Basak <[e-mail]>  Fri, 08 Jun 2012 11:37:31 +0100
+
+apache2 (2.2.22-6) unstable; urgency=low
+
+  [ Stefan Fritsch ]
+  * Fix regression causing apache2 to cache "206 partial content" responses,
+    and then serving these partial responses when replying to normal requests.
+    Closes: #671204
+  * Add section to security.conf that shows how to forbid access to VCS
+    directories. Closes: #548213
+  * Update ssl default cipher config, add alternative speed optimized config.
+    Closes: #649020
+  * Add "AddCharset" for .brf files in default mod_mime config.
+    Closes: #402567
+  * Don't create httpd.conf anymore and don't include it in apache2.conf. If
+    it contains local modifications, move it to /etc/apache2/conf.d/httpd.conf
+  * Port some of the comments in apache2.conf from the 2.4 package.
+  * Compile mod_version statically, drop associated module load file.
+  * If apache2 is not running, make "/etc/init.d/apache2 reload" skip the
+    configtest.
+  * Note in README.Debian that future versions of the package will have the
+    include statements changed to include only *.conf.
+  * Change compiled-in document root to /var/www, to avoid strange error
+    messages.
+  * Use "dh --with autotools_dev" instead of patching config.sub/config.guess.
+
+  [ Arno Töll ]
+  * Fix apxs to import LDFLAGS from config_vars.mk. Moreover, make it possible
+    to override LDFLAGS at compile time by defining LDLAGS in the environment,
+    just like it is possible for CFLAGS. This also means, config_vars.mk now
+    exports hardening build flags by default.
+  * Update doc-base metadata for the apache2-doc package.
+
+ -- Stefan Fritsch <[e-mail]>  Tue, 29 May 2012 22:05:48 +0200
+
+apache2 (2.2.22-5) unstable; urgency=low
+
+  * Make LoadFile and LoadModule look in the standard search paths if the
+    dso file name is given as a pure filename. This helps with the multi-arch
+    transition.
+
+ -- Stefan Fritsch <[e-mail]>  Mon, 30 Apr 2012 23:38:33 +0200
+
+apache2 (2.2.22-4) unstable; urgency=high
+
+  * CVE-2012-0216: Remove "Alias /doc /usr/share/doc" from the default virtual
+    hosts' config files.
+    If scripting modules like mod_php or mod_rivet are enabled on systems
+    where either 1) some frontend server forwards connections to an apache2
+    backend server on the localhost address, or 2) the machine running
+    apache2 is also used for web browsing, this could allow a remote
+    attacker to execute example scripts stored under /usr/share/doc.
+    Depending on the installed packages, this could lead to issues like cross
+    site scripting, code execution, or leakage of sensitive data.
+
+ -- Stefan Fritsch <[e-mail]>  Sun, 15 Apr 2012 23:41:43 +0200
+
 apache2 (2.2.22-3) unstable; urgency=low
 
   * Fix "FTBFS: mkdir: cannot create directory `debian/build-tree/arch':
@@ -1707,6 +3162,18 @@ apache2 (2.2.22-2) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Thu, 15 Mar 2012 00:02:31 +0100
 
+apache2 (2.2.22-1ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Sun, 12 Feb 2012 20:06:35 -0500
+
 apache2 (2.2.22-1) unstable; urgency=low
 
    [ Stefan Fritsch ]
@@ -1724,6 +3191,18 @@ apache2 (2.2.22-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Wed, 01 Feb 2012 21:49:04 +0100
 
+apache2 (2.2.21-5ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Mon, 09 Jan 2012 06:26:31 +0000
+
 apache2 (2.2.21-5) unstable; urgency=low
 
   [ Arno Töll ]
@@ -1777,6 +3256,26 @@ apache2 (2.2.21-4) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Thu, 29 Dec 2011 12:09:14 +0100
 
+apache2 (2.2.21-3ubuntu2) precise; urgency=low
+
+  * d/ask-for-passphrase: Flip the logic of this script so that it checks
+    first to see if apache is being started from a TTY, and then if not,
+    tries plymouth. (LP: #887410)
+
+ -- Clint Byrum <[e-mail]>  Tue, 06 Dec 2011 16:49:33 -0800
+
+apache2 (2.2.21-3ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Fri, 09 Dec 2011 05:20:43 +0000
+
 apache2 (2.2.21-3) unstable; urgency=medium
 
   * Fix CVE-2011-4317: Prevent unintended pattern expansion in some
@@ -1791,6 +3290,24 @@ apache2 (2.2.21-3) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sat, 03 Dec 2011 18:54:03 +0100
 
+apache2 (2.2.21-2ubuntu2) precise; urgency=low
+
+  * No-change rebuild to drop spurious libsfgcc1 dependency on armhf.
+
+ -- Adam Conrad <[e-mail]>  Fri, 02 Dec 2011 17:36:28 -0700
+
+apache2 (2.2.21-2ubuntu1) precise; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Fri, 14 Oct 2011 16:01:29 +0000
+
 apache2 (2.2.21-2) unstable; urgency=high
 
   * Fix CVE-2011-3368: Prevent unintended pattern expansion in some
@@ -1808,6 +3325,19 @@ apache2 (2.2.21-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Mon, 26 Sep 2011 18:16:11 +0200
 
+apache2 (2.2.20-1ubuntu1) oneiric; urgency=low
+
+  * Merge from debian unstable to fix CVE-2011-3192 (LP: #837991).
+    Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Steve Beattie <[e-mail]>  Tue, 06 Sep 2011 01:17:15 -0700
+
 apache2 (2.2.20-1) unstable; urgency=low
 
   * New upstream release.
@@ -1830,6 +3360,18 @@ apache2 (2.2.19-2) unstable; urgency=high
 
  -- Stefan Fritsch <[e-mail]>  Mon, 29 Aug 2011 17:08:17 +0200
 
+apache2 (2.2.19-1ubuntu1) oneiric; urgency=low
+
+  * Merge from debian unstable (LP: #787013). Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Andres Rodriguez <[e-mail]>  Mon, 23 May 2011 10:16:09 -0400
+
 apache2 (2.2.19-1) unstable; urgency=low
 
   * New upstream release.
@@ -1847,6 +3389,18 @@ apache2 (2.2.19-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sun, 22 May 2011 10:21:21 +0200
 
+apache2 (2.2.17-3ubuntu1) oneiric; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debain/apache2.py, debian/apache2.2-common.isntall: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Mon, 11 Apr 2011 02:13:30 +0100
+
 apache2 (2.2.17-3) unstable; urgency=low
 
   * Fix compilation with OpenSSL without SSLv2 support. Closes: #622049
@@ -1873,6 +3427,18 @@ apache2 (2.2.17-2) unstable; urgency=high
 
  -- Stefan Fritsch <[e-mail]>  Mon, 21 Mar 2011 23:01:17 +0100
 
+apache2 (2.2.17-1ubuntu1) natty; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debain/apache2.py, debian/apache2.2-common.isntall: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase. 
+
+ -- Chuck Short <[e-mail]>  Tue, 22 Feb 2011 13:02:08 -0500
+
 apache2 (2.2.17-1) unstable; urgency=low
 
   * New upstream version
@@ -1881,6 +3447,32 @@ apache2 (2.2.17-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Tue, 15 Feb 2011 23:30:18 +0100
 
+apache2 (2.2.16-6ubuntu3) natty; urgency=low
+
+  * debian/rules: Don't use "-fno-strict-aliasing" since it causes
+    apache FTBFS on amd64. (LP: #711293) 
+
+ -- Chuck Short <[e-mail]>  Tue, 01 Feb 2011 10:19:55 -0500
+
+apache2 (2.2.16-6ubuntu2) natty; urgency=low
+
+  * debian/rules: Use "-fno-strict-aliasing" to work around a gcc bug.
+   (LP: #697105) 
+
+ -- Chuck Short <[e-mail]>  Tue, 25 Jan 2011 11:14:58 -0500
+
+apache2 (2.2.16-6ubuntu1) natty; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debain/apache2.py, debian/apache2.2-common.isntall: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Sun, 02 Jan 2011 06:05:51 +0000
+
 apache2 (2.2.16-6) unstable; urgency=low
 
   * Also add $named to the secondary-init-script example.
@@ -1896,6 +3488,30 @@ apache2 (2.2.16-5) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Fri, 31 Dec 2010 01:22:19 +0100
 
+apache2 (2.2.16-4ubuntu2) natty; urgency=low
+
+  [Clint Byrum]
+  * Adding plymouth aware passphrase dialog program ask-for-passphrase.
+    (LP: #582963)
+    + debian/control: apache2.2-common depends on bash for ask-for-passphrase
+    + debian/config-dir/mods-available/ssl.conf:
+      - SSLPassPhraseDialog now uses exec:/usr/share/apache2/ask-for-passhrase
+
+  [Chuck Short]
+  * Add apport hook. (LP: #609177)
+    + debian/apache2.py, debian/apache2.2-common.install
+
+ -- Chuck Short <[e-mail]>  Mon, 22 Nov 2010 09:43:43 -0500
+
+apache2 (2.2.16-4ubuntu1) natty; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+
+ -- Chuck Short <[e-mail]>  Mon, 22 Nov 2010 09:43:41 -0500
+
 apache2 (2.2.16-4) unstable; urgency=medium
 
   * Increase the mod_reqtimeout default timeouts to avoid potential problems
@@ -1906,6 +3522,15 @@ apache2 (2.2.16-4) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 14 Nov 2010 19:05:55 +0100
 
+apache2 (2.2.16-3ubuntu1) natty; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree.
+
+ -- Chuck Short <[e-mail]>  Tue, 12 Oct 2010 11:54:48 +0100
+
 apache2 (2.2.16-3) unstable; urgency=high
 
   * CVE-2010-1623: mod_reqtimeout: Fix potential DoS by high memory usage.
@@ -1928,6 +3553,30 @@ apache2 (2.2.16-2) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sun, 29 Aug 2010 15:29:21 +0200
 
+apache2 (2.2.16-1ubuntu3) maverick; urgency=low
+
+  * Revert "stty sane" to unbreak apache starting, this will have to be
+    fixed a different way. (LP: #626723) 
+
+ -- Chuck Short <[e-mail]>  Wed, 08 Sep 2010 08:33:17 -0400
+
+apache2 (2.2.16-1ubuntu2) maverick; urgency=low
+
+  * debian/apache2.2-common.apache2.init: Add stty sane so that users will get a 
+    password prompt when using apache-ssl. (LP: #582963)
+
+ -- Chuck Short <[e-mail]>  Wed, 25 Aug 2010 09:25:05 -0400
+
+apache2 (2.2.16-1ubuntu1) maverick; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree.
+    - debian/apache2-2.common.apache2.init: Add graceful restart (LP: #456381)
+
+ -- Chuck Short <[e-mail]>  Mon, 26 Jul 2010 20:21:37 +0100
+
 apache2 (2.2.16-1) unstable; urgency=medium
 
   * Urgency medium for security fix.
@@ -1960,6 +3609,24 @@ apache2 (2.2.15-6) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Fri, 16 Jul 2010 23:41:08 +0200
 
+apache2 (2.2.15-5ubuntu1) maverick; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree.
+    - debian/apache2-2.common.apache2.init: Add graceful restart (LP: #456381)
+    + Dropped:
+      - debian/patches/206-fix-potential-memory-leaks.dpatch: No longer needed.
+      - debian/patches/206-report-max-client-mpm-worker.dpatch: No longer needed.
+      - debian/config-dir/apache2.conf: Merged back from debian.
+      - mod-reqtimeout functionality: Merge back from debian.
+      - debian/patches/204_CVE-2010-0408.dpatch: No longer needed.
+      - debian/patches/205_CVE-2010-0434.dpatch: No longer needed.
+      - debian/patches/203_fix-ab-segfault.dpatch: No longer needed.
+
+ -- Chuck Short <[e-mail]>  Wed, 05 May 2010 01:28:04 +0100
+
 apache2 (2.2.15-5) unstable; urgency=low
 
   * Conflict with apache package as we now include apachectl. Closes: #579065
@@ -2080,6 +3747,80 @@ apache2 (2.2.14-6) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sun, 07 Feb 2010 17:29:45 +0100
 
+apache2 (2.2.14-5ubuntu8) lucid; urgency=low
+
+  * debian/patches/210-backport-mod-reqtimeout-ftbfs.dpatch: Add missing mod_reqtime.so
+    (LP: #562370) 
+
+ -- Chuck Short <[e-mail]>  Tue, 13 Apr 2010 15:09:57 -0400
+
+apache2 (2.2.14-5ubuntu7) lucid; urgency=low
+
+  * debian/patches/206-fix-potential-memory-leaks.dpatch: Fix potential memory
+    leaks by making sure to not destroy bucket brigades that have been created
+    by earlier filters. Backported from 2.2.15.
+  * debian/patches/206-report-max-client-mpm-worker.dpatch: Don't report server 
+    has reached MaxClients until it has. Backported from 2.2.15
+  * debian/config-dir/apache2.conf: Make the Files ~ "^\.ht" block in apache2.conf 
+    more secure by adding Satisfy all. (Debian bug: #572075)
+  * debian/rules, debian/patches/209-backport-mod-reqtimeout.dpatch, 
+    debian/config2-dir/mods-available/reqtimeout.load,
+    debian/config2-dir/mods-available/reqtimeout.conf debian/NEWS : Backport the 
+    mod-reqtimeout module from 2.2.15, this will mitigate apache slowloris
+    bug in apache. Enable it by default. (LP: #392759)
+
+ -- Chuck Short <[e-mail]>  Mon, 05 Apr 2010 09:53:35 -0400
+
+apache2 (2.2.14-5ubuntu6) lucid; urgency=low
+
+  * debian/apache2.2-common.apache2.init: Fix thinko. (LP: #551681) 
+
+ -- Chuck Short <[e-mail]>  Tue, 30 Mar 2010 09:41:11 -0400
+
+apache2 (2.2.14-5ubuntu5) lucid; urgency=low
+
+  * Revert 99-fix-mod-dav-permissions.dpatch 
+
+ -- Chuck Short <[e-mail]>  Tue, 30 Mar 2010 07:55:46 -0400
+
+apache2 (2.2.14-5ubuntu4) lucid; urgency=low
+
+  * debian/patches/99-fix-mod-dav-permissions.dpatch: Fix permisisons when 
+    downloading files from webdav (LP: #540747)
+  * debian/apache2.2-common.apache2.init: Add graceful restart (LP: #456381)
+
+ -- Chuck Short <[e-mail]>  Mon, 29 Mar 2010 13:37:39 -0400
+
+apache2 (2.2.14-5ubuntu3) lucid; urgency=low
+
+  * SECURITY UPDATE: denial of service via crafted request in mod_proxy_ajp
+    - debian/patches/204_CVE-2010-0408.dpatch: return the right error code
+      in modules/proxy/mod_proxy_ajp.c.
+    - CVE-2010-0408
+  * SECURITY UPDATE: information disclosure via improper handling of
+    headers in subrequests
+    - debian/patches/205_CVE-2010-0434.dpatch: use a copy of r->headers_in
+      in server/protocol.c.
+    - CVE-2010-0434
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 10 Mar 2010 14:48:48 -0500
+
+apache2 (2.2.14-5ubuntu2) lucid; urgency=low
+
+  * debian/patches/203_fix-ab-segfault.dpatch: Fix segfaulting ab when using really
+    wacky options. (LP: #450501) 
+
+ -- Chuck Short <[e-mail]>  Mon, 08 Mar 2010 14:53:17 -0500
+
+apache2 (2.2.14-5ubuntu1) lucid; urgency=low
+
+  * Merge from debian testing.  Remaining changes: LP: #506862
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree.
+
+ -- Bhavani Shankar <[e-mail]>  Wed, 13 Jan 2010 14:28:41 +0530
+
 apache2 (2.2.14-5) unstable; urgency=low
 
   * Security: Further mitigation for the TLS renegotation attack
@@ -2103,6 +3844,15 @@ apache2 (2.2.14-5) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sat, 02 Jan 2010 22:44:15 +0100
 
+apache2 (2.2.14-4ubuntu1) lucid; urgency=low
+
+  * Resynchronzie with Debian, remaining changes are:
+   - debian/{control, rules}: Enable PIE hardening.
+   - debian/{control, rules, pache2.2-common.ufw.profile}: Add ufw profiles.
+   - debian/control: Add bzr tag and point it to our tree.
+
+ -- Chuck Short <[e-mail]>  Wed, 23 Dec 2009 14:44:51 -0500
+
 apache2 (2.2.14-4) unstable; urgency=low
 
   * Disable localized error pages again by default because they break
@@ -2153,6 +3903,17 @@ apache2 (2.2.14-2) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sat, 07 Nov 2009 14:37:37 +0100
 
+apache2 (2.2.14-1ubuntu1) lucid; urgency=low
+
+  * Merge from debian testing, remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, pache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/conrol: Add bzr tag and point it to our tree.
+    - Dropped debian/patches/203_fix_legacy_ap_rputs_segfaults.dpatch: 
+      Already applied upstream.
+
+ -- Chuck Short <[e-mail]>  Fri, 06 Nov 2009 00:29:03 +0000
+
 apache2 (2.2.14-1) unstable; urgency=low
 
   * New upstream version:
@@ -2187,6 +3948,24 @@ apache2 (2.2.13-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Mon, 31 Aug 2009 20:28:56 +0200
 
+apache2 (2.2.12-1ubuntu2) karmic; urgency=low
+
+  * debian/patches/203_fix_legacy_ap_rputs_segfaults.dpatch: 
+    - Fix potential segfaults with the use of the legacy ap_rputs() etc
+      interfaces, in cases where an output filter fails. This happens
+      frequently after CVE-2009-1891 got fixed. (LP: #409987) 
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 17 Aug 2009 15:38:47 -0400
+
+apache2 (2.2.12-1ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+    - Dropped debian/patches/203_fix-ssl-timeftm-ignored.dpatch.
+
+ -- Chuck Short <[e-mail]>  Tue, 04 Aug 2009 20:04:24 +0100
+
 apache2 (2.2.12-1) unstable; urgency=low
 
   * New upstream release:
@@ -2234,6 +4013,16 @@ apache2 (2.2.12-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Tue, 04 Aug 2009 11:02:34 +0200
 
+apache2 (2.2.11-7ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable, remaining changes: LP: #398130
+    - debian/patches/203_fix-ssl-timeftm-ignored.dpatch:
+      Fix timefmt is ignored when XBitHack is on. (LP: #258914)
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Bhavani Shankar <[e-mail]>  Sat, 11 Jul 2009 16:34:32 +0530
+
 apache2 (2.2.11-7) unstable; urgency=low
 
   * Security fixes:
@@ -2248,6 +4037,16 @@ apache2 (2.2.11-7) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Fri, 10 Jul 2009 22:42:57 +0200
 
+apache2 (2.2.11-6ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/patches/203_fix-ssl-timeftm-ignored.dpatch:
+      Fix timefmt is ignored when XBitHack is on. (LP: #258914)
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Chuck Short <[e-mail]>  Tue, 09 Jun 2009 01:01:23 +0100
+
 apache2 (2.2.11-6) unstable; urgency=high
 
   * CVE-2009-1195: mod_include allowed to bypass IncludesNoExec for Server
@@ -2256,6 +4055,16 @@ apache2 (2.2.11-6) unstable; urgency=high
 
  -- Stefan Fritsch <[e-mail]>  Mon, 08 Jun 2009 19:22:58 +0200
 
+apache2 (2.2.11-5ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/patches/203_fix-ssi-timeftm-ignored.dpatch: 
+      Fix timefmt is ignored when XBitHack is on. (LP: #258914) 
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Andrew Mitchell <[e-mail]>  Wed, 03 Jun 2009 14:10:54 +1200
+
 apache2 (2.2.11-5) unstable; urgency=low
 
   * Move all binaries into a new package apache2.2-bin and make
@@ -2304,6 +4113,16 @@ apache2 (2.2.11-4) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Tue, 19 May 2009 22:55:27 +0200
 
+apache2 (2.2.11-3ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/patches/203_fix-ssi-timeftm-ignored.dpatch: 
+      Fix timefmt is ignored when XBitHack is on. (LP: #258914) 
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Andrew Mitchell <[e-mail]>  Tue, 12 May 2009 16:15:34 +1200
+
 apache2 (2.2.11-3) unstable; urgency=low
 
   * Rebuild against apr-util 1.3, to fix undefined symbol errors in mod_ldap
@@ -2312,6 +4131,21 @@ apache2 (2.2.11-3) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Tue, 31 Mar 2009 21:07:26 +0200
 
+apache2 (2.2.11-2ubuntu2) jaunty; urgency=low
+
+  * debian/patches/203_fix-ssi-timeftm-ignored.dpatch: 
+    Fix timefmt is ignored when XBitHack is on. (LP: #258914) 
+
+ -- Chuck Short <[e-mail]>  Wed, 01 Apr 2009 11:39:17 -0400
+
+apache2 (2.2.11-2ubuntu1) jaunty; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{contro,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Chuck Short <[e-mail]>  Sat, 17 Jan 2009 00:02:55 +0000
+
 apache2 (2.2.11-2) unstable; urgency=low
 
   * Report an error instead instead of segfaulting when apr_pollset_create
@@ -2321,6 +4155,14 @@ apache2 (2.2.11-2) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Fri, 16 Jan 2009 19:01:59 +0100
 
+apache2 (2.2.11-1ubuntu1) jaunty; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{control, rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Chuck Short <[e-mail]>  Mon, 15 Dec 2008 00:06:50 +0000
+
 apache2 (2.2.11-1) unstable; urgency=low
 
   [Thom May]
@@ -2335,6 +4177,14 @@ apache2 (2.2.11-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sun, 14 Dec 2008 09:34:24 +0100
 
+apache2 (2.2.9-11ubuntu1) jaunty; urgency=low
+
+  * Merge from debian unstable, remaining changes: (LP: #303375)
+    - debian/{control, rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Bhavani Shankar <[e-mail]>  Sat, 29 Nov 2008 14:02:31 +0530
+
 apache2 (2.2.9-11) unstable; urgency=low
 
   * Regression fix from upstream svn for mod_proxy:
@@ -2349,6 +4199,14 @@ apache2 (2.2.9-11) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Wed, 26 Nov 2008 23:10:22 +0100
 
+apache2 (2.2.9-10ubuntu1) jaunty; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{control, rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Chuck Short <[e-mail]>  Wed, 05 Nov 2008 02:23:18 -0400
+
 apache2 (2.2.9-10) unstable; urgency=low
 
   * Regression fix from upstream svn for mod_proxy_http:
@@ -2379,6 +4237,27 @@ apache2 (2.2.9-8) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Thu, 11 Sep 2008 09:17:33 +0200
 
+apache2 (2.2.9-7ubuntu3) intrepid; urgency=low
+
+  * Revert logrotate change since it will break it for everyone. 
+
+ -- Chuck Short <[e-mail]>  Fri, 19 Sep 2008 09:32:01 -0400
+
+apache2 (2.2.9-7ubuntu2) intrepid; urgency=low
+
+  * debian/logrotate: Restart rather than reload for busy websites.
+    (LP: #270899) 
+
+ -- Chuck Short <[e-mail]>  Thu, 18 Sep 2008 08:42:22 -0400
+
+apache2 (2.2.9-7ubuntu1) intrepid; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control,rules,apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Kees Cook <[e-mail]>  Thu, 28 Aug 2008 08:10:59 -0700
+
 apache2 (2.2.9-7) unstable; urgency=low
 
   * Fix XSS in mod_proxy_ftp (CVE-2008-2939).
@@ -2421,6 +4300,23 @@ apache2 (2.2.9-4) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sun, 06 Jul 2008 10:38:37 +0200
 
+apache2 (2.2.9-3ubuntu2) intrepid; urgency=low
+
+  * add ufw integration (see
+    https://wiki.ubuntu.com/UbuntuFirewall#Integrating%20UFW%20with%20Packages)
+    (LP: #261198)
+    - debian/control: suggest ufw for apache2.2-common
+    - add apache2.2-common.ufw.profile with 3 profiles and install it to
+      /etc/ufw/applications.d/apache2.2-common
+
+ -- Didier Roche <[e-mail]>  Tue, 26 Aug 2008 19:03:42 +0200
+
+apache2 (2.2.9-3ubuntu1) intrepid; urgency=low
+
+  * debian/{control,rules}: enable PIE hardening
+
+ -- Kees Cook <[e-mail]>  Wed, 20 Aug 2008 15:45:00 -0700
+
 apache2 (2.2.9-3) unstable; urgency=low
 
   [ Stefan Fritsch ]
@@ -3991,9 +5887,7 @@ apache2 (2.0.37-1) unstable; urgency=low
  -- Thom May <[e-mail]>  Thu, 13 Jun 2002 17:47:12 +0100
 
 apache2 (2.0.37+cvs.JCW_PRE2_2037-1) unstable; urgency=low
-
   * New upstream release
-
  -- Thom May <[e-mail]>  Wed,  5 Jun 2002 12:42:34 +0100
 
 apache2 (2.0.36-2) unstable; urgency=low
@@ -4501,3 +6395,4 @@ apache2 (2.0.18-1) unstable; urgency=low
   * Initial Release.
 
  -- Daniel Stone <[e-mail]>  Wed,  4 Jul 2001 21:29:29 +1000
+
diff --git a/debian/control b/debian/control
index 5465d60..ed2c254 100644
--- a/debian/control
+++ b/debian/control
@@ -1,5 +1,6 @@
 Source: apache2
-Maintainer: Debian Apache Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian Apache Maintainers <[e-mail]>
 Uploaders: Stefan Fritsch <[e-mail]>,
            Arno Töll <[e-mail]>,
            Ondřej Surý <[e-mail]>,
@@ -44,7 +45,12 @@ Depends: apache2-bin (= ${binary:Version}),
 Recommends: ssl-cert
 Suggests: apache2-doc,
           apache2-suexec-pristine | apache2-suexec-custom,
+<<<<<<< debian/control
           www-browser
+=======
+          www-browser,
+          ufw
+>>>>>>> debian/control
 Pre-Depends: ${misc:Pre-Depends}
 Conflicts: apache2.2-bin,
            apache2.2-common
diff --git a/debian/icons/ubuntu-logo.png b/debian/icons/ubuntu-logo.png
 new file mode 100644
index 0000000..4db2fa1
 Binary files /dev/null and b/debian/icons/ubuntu-logo.png differ
diff --git a/debian/index.html b/debian/index.html
index 766401d..96ed444 100644
--- a/debian/index.html
+++ b/debian/index.html
@@ -1,9 +1,14 @@
 
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml">
+  <!--
+    Modified from the Debian original for Ubuntu
+    Last updated: 2016-11-16
+    See: https://launchpad.net/bugs/1288690
+  -->
   <head>
     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
-    <title>Apache2 Debian Default Page: It works</title>
+    <title>Apache2 Ubuntu Default Page: It works</title>
     <style type="text/css" media="screen">
   * {
     margin: 0px 0px 0px 0px;
@@ -188,9 +193,9 @@
   <body>
     <div class="main_page">
       <div class="page_header floating_element">
-        <img src="/icons/openlogo-75.png" alt="Debian Logo" class="floating_element"/>
+        <img src="/icons/ubuntu-logo.png" alt="Ubuntu Logo" class="floating_element"/>
         <span class="floating_element">
-          Apache2 Debian Default Page
+          Apache2 Ubuntu Default Page
         </span>
       </div>
 <!--      <div class="table_of_contents floating_element">
@@ -221,7 +226,9 @@
         <div class="content_section_text">
           <p>
                 This is the default welcome page used to test the correct 
-                operation of the Apache2 server after installation on Debian systems.
+                operation of the Apache2 server after installation on Ubuntu systems.
+                It is based on the equivalent page on Debian, from which the Ubuntu Apache
+                packaging is derived.
                 If you can read this page, it means that the Apache HTTP server installed at
                 this site is working properly. You should <b>replace this file</b> (located at
                 <tt>/var/www/html/index.html</tt>) before continuing to operate your HTTP server.
@@ -242,9 +249,9 @@
         </div>
         <div class="content_section_text">
           <p>
-                Debian's Apache2 default configuration is different from the
+                Ubuntu's Apache2 default configuration is different from the
                 upstream default configuration, and split into several files optimized for
-                interaction with Debian tools. The configuration system is
+                interaction with Ubuntu tools. The configuration system is
                 <b>fully documented in
                 /usr/share/doc/apache2/README.Debian.gz</b>. Refer to this for the full
                 documentation. Documentation for the web server itself can be
@@ -253,7 +260,7 @@
 
           </p>
           <p>
-                The configuration layout for an Apache2 web server installation on Debian systems is as follows:
+                The configuration layout for an Apache2 web server installation on Ubuntu systems is as follows:
           </p>
           <pre>
 /etc/apache2/
@@ -324,7 +331,7 @@
 
         <div class="content_section_text">
             <p>
-                By default, Debian does not allow access through the web browser to
+                By default, Ubuntu does not allow access through the web browser to
                 <em>any</em> file apart of those located in <tt>/var/www</tt>,
                 <a href="http://httpd.apache.org/docs/2.4/mod/mod_userdir.html" rel="nofollow">public_html</a>
                 directories (when enabled) and <tt>/usr/share</tt> (for web
@@ -333,7 +340,7 @@
                 document root directory in <tt>/etc/apache2/apache2.conf</tt>.
             </p>
             <p>
-                The default Debian document root is <tt>/var/www/html</tt>. You
+                The default Ubuntu document root is <tt>/var/www/html</tt>. You
                 can make your own virtual hosts under /var/www. This is different
                 to previous releases which provides better security out of the box.
             </p>
@@ -345,9 +352,9 @@
         </div>
         <div class="content_section_text">
           <p>
-                Please use the <tt>reportbug</tt> tool to report bugs in the
-                Apache2 package with Debian. However, check <a
-                href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?ordering=normal;archive=0;src=apache2;repeatmerged=0"
+                Please use the <tt>ubuntu-bug</tt> tool to report bugs in the
+                Apache2 package with Ubuntu. However, check <a
+                href="https://bugs.launchpad.net/ubuntu/+source/apache2"
                 rel="nofollow">existing bug reports</a> before reporting a new bug.
           </p>
           <p>
diff --git a/debian/patches/series b/debian/patches/series
index ed0c2ec..b6bc836 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -11,3 +11,16 @@ fix-macro.patch
 
 # This patch is applied manually
 #suexec-custom.patch
+<<<<<<< debian/patches/series
+=======
+support-openssl3-001.patch
+support-openssl3-002.patch
+support-openssl3-003.patch
+support-openssl3-004.patch
+support-openssl3-005.patch
+support-openssl3-006.patch
+support-openssl3-007.patch
+support-openssl3-008.patch
+support-openssl3-009.patch
+support-openssl3-010.patch
+>>>>>>> debian/patches/series
diff --git a/debian/patches/support-openssl3-001.patch b/debian/patches/support-openssl3-001.patch
 new file mode 100644
index 0000000..d7d386d
--- /dev/null
+++ b/debian/patches/support-openssl3-001.patch
@@ -0,0 +1,88 @@
+From: Joe Orton <[e-mail]>
+Date: Mon, 26 Jul 2021 12:23:24 +0100
+Subject: add some log messages and AP_DEBUG_ASSERTs for functions that should
+ never be called
+
+Submitted by: sf
+
+
+Forwarded: yes, https://github.com/apache/httpd/pull/258
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1951476
+---
+ modules/ssl/ssl_engine_io.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c
+index cabf753..ed9db54 100644
+--- a/modules/ssl/ssl_engine_io.c
++++ b/modules/ssl/ssl_engine_io.c
+@@ -194,6 +194,10 @@ static int bio_filter_destroy(BIO *bio)
+ static int bio_filter_out_read(BIO *bio, char *out, int outl)
+ {
+     /* this is never called */
++    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)(bio->ptr);
++    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
++                  "BUG: %s() should not be called", "bio_filter_out_read");
++    AP_DEBUG_ASSERT(0);
+     return -1;
+ }
+ 
+@@ -293,12 +297,20 @@ static long bio_filter_out_ctrl(BIO *bio, int cmd, long num, void *ptr)
+ static int bio_filter_out_gets(BIO *bio, char *buf, int size)
+ {
+     /* this is never called */
++    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)(bio->ptr);
++    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
++                  "BUG: %s() should not be called", "bio_filter_out_gets");
++    AP_DEBUG_ASSERT(0);
+     return -1;
+ }
+ 
+ static int bio_filter_out_puts(BIO *bio, const char *str)
+ {
+     /* this is never called */
++    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)(bio->ptr);
++    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
++                  "BUG: %s() should not be called", "bio_filter_out_puts");
++    AP_DEBUG_ASSERT(0);
+     return -1;
+ }
+ 
+@@ -533,21 +545,37 @@ static int bio_filter_in_read(BIO *bio, char *in, int inlen)
+ 
+ static int bio_filter_in_write(BIO *bio, const char *in, int inl)
+ {
++    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)(bio->ptr);
++    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
++                  "BUG: %s() should not be called", "bio_filter_in_write");
++    AP_DEBUG_ASSERT(0);
+     return -1;
+ }
+ 
+ static int bio_filter_in_puts(BIO *bio, const char *str)
+ {
++    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)(bio->ptr);
++    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
++                  "BUG: %s() should not be called", "bio_filter_in_puts");
++    AP_DEBUG_ASSERT(0);
+     return -1;
+ }
+ 
+ static int bio_filter_in_gets(BIO *bio, char *buf, int size)
+ {
++    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)(bio->ptr);
++    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
++                  "BUG: %s() should not be called", "bio_filter_in_gets");
++    AP_DEBUG_ASSERT(0);
+     return -1;
+ }
+ 
+ static long bio_filter_in_ctrl(BIO *bio, int cmd, long num, void *ptr)
+ {
++    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)(bio->ptr);
++    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
++                  "BUG: %s() should not be called", "bio_filter_in_ctrl");
++    AP_DEBUG_ASSERT(0);
+     return -1;
+ }
+ 
diff --git a/debian/patches/support-openssl3-002.patch b/debian/patches/support-openssl3-002.patch
 new file mode 100644
index 0000000..3a56106
--- /dev/null
+++ b/debian/patches/support-openssl3-002.patch
@@ -0,0 +1,345 @@
+From: Joe Orton <[e-mail]>
+Date: Mon, 26 Jul 2021 12:24:24 +0100
+Subject: mod_ssl: add compatibility with OpenSSL 3.0.0
+
+Wrappers around deprecated API:
+* X509_STORE_load_locations() => modssl_X509_STORE_load_locations(),
+* CTX_load_verify_locations() => modssl_CTX_load_verify_locations(),
+* ERR_peek_error_line_data()  => modssl_ERR_peek_error_data(),
+* DH_bits(dh)                 => BN_num_bits(DH_get0_p(dh)).
+
+Provide a compatible version of ssl_callback_SessionTicket() which does not
+use the deprecated HMAC_CTX and HMAC_Init_ex(), replaced by EVP_MAC_CTX and
+EVP_MAC_CTX_set_params() respectively. This requires adapting struct
+modssl_ticket_key_t to replace hmac_secret[] with OSSL_PARAM mac_params[],
+created once at load time still.
+The callback is registered by SSL_CTX_set_tlsext_ticket_key_evp_cb() instead
+of SSL_CTX_set_tlsext_ticket_key_cb().
+
+Since BIO_eof() may now be called openssl-3 state machine, the never-called
+assertion in bio_filter_in_ctrl() does not hold anymore, and we have to
+handle BIO_CTRL_EOF. For any other cmd, we continue to AP_DEBUG_ASSERT(0) and
+log an error, yet the return value is changed from -1 to 0 which is the usual
+unhandled value.
+
+Note that OpenSSL 3.0.0 is still in alpha stage as of now, the API shouldn't
+change though, neither breakage to 1.x.x API.
+
+Submitted by: ylavic
+
+
+Forwarded: yes, https://github.com/apache/httpd/pull/258
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1951476
+---
+ modules/ssl/ssl_engine_init.c   | 76 ++++++++++++++++++++++++++++++++---------
+ modules/ssl/ssl_engine_io.c     | 17 ++++++---
+ modules/ssl/ssl_engine_kernel.c | 22 ++++++++++--
+ modules/ssl/ssl_engine_log.c    | 12 ++++++-
+ modules/ssl/ssl_private.h       | 19 +++++++++--
+ 5 files changed, 120 insertions(+), 26 deletions(-)
+
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index 4da24ed..eb41e7f 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -843,6 +843,23 @@ static void ssl_init_ctx_callbacks(server_rec *s,
+ #endif
+ }
+ 
++static APR_INLINE
++int modssl_CTX_load_verify_locations(SSL_CTX *ctx,
++                                     const char *file,
++                                     const char *path)
++{
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++    if (!SSL_CTX_load_verify_locations(ctx, file, path))
++        return 0;
++#else
++    if (file && !SSL_CTX_load_verify_file(ctx, file))
++        return 0;
++    if (path && !SSL_CTX_load_verify_dir(ctx, path))
++        return 0;
++#endif
++    return 1;
++}
++
+ static apr_status_t ssl_init_ctx_verify(server_rec *s,
+                                         apr_pool_t *p,
+                                         apr_pool_t *ptemp,
+@@ -883,10 +900,8 @@ static apr_status_t ssl_init_ctx_verify(server_rec *s,
+         ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s,
+                      "Configuring client authentication");
+ 
+-        if (!SSL_CTX_load_verify_locations(ctx,
+-                                           mctx->auth.ca_cert_file,
+-                                           mctx->auth.ca_cert_path))
+-        {
++        if (!modssl_CTX_load_verify_locations(ctx, mctx->auth.ca_cert_file,
++                                                   mctx->auth.ca_cert_path)) {
+             ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01895)
+                     "Unable to configure verify locations "
+                     "for client authentication");
+@@ -971,6 +986,23 @@ static apr_status_t ssl_init_ctx_cipher_suite(server_rec *s,
+     return APR_SUCCESS;
+ }
+ 
++static APR_INLINE
++int modssl_X509_STORE_load_locations(X509_STORE *store,
++                                     const char *file,
++                                     const char *path)
++{
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++    if (!X509_STORE_load_locations(store, file, path))
++        return 0;
++#else
++    if (file && !X509_STORE_load_file(store, file))
++        return 0;
++    if (path && !X509_STORE_load_path(store, path))
++        return 0;
++#endif
++    return 1;
++}
++
+ static apr_status_t ssl_init_ctx_crl(server_rec *s,
+                                      apr_pool_t *p,
+                                      apr_pool_t *ptemp,
+@@ -1009,8 +1041,8 @@ static apr_status_t ssl_init_ctx_crl(server_rec *s,
+     ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900)
+                  "Configuring certificate revocation facility");
+ 
+-    if (!store || !X509_STORE_load_locations(store, mctx->crl_file,
+-                                             mctx->crl_path)) {
++    if (!store || modssl_X509_STORE_load_locations(store, mctx->crl_file,
++                                                          mctx->crl_path)) {
+         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901)
+                      "Host %s: unable to configure X.509 CRL storage "
+                      "for certificate revocation", mctx->sc->vhost_id);
+@@ -1249,7 +1281,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+     const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile;
+     int i;
+     X509 *cert;
+-    DH *dhparams;
++    DH *dh;
+ #ifdef HAVE_ECC
+     EC_GROUP *ecparams = NULL;
+     int nid;
+@@ -1434,12 +1466,12 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+      */
+     certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *);
+     if (certfile && !modssl_is_engine_id(certfile)
+-        && (dhparams = ssl_dh_GetParamFromFile(certfile))) {
+-        SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams);
++        && (dh = ssl_dh_GetParamFromFile(certfile))) {
++        SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh);
+         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
+                      "Custom DH parameters (%d bits) for %s loaded from %s",
+-                     DH_bits(dhparams), vhost_id, certfile);
+-        DH_free(dhparams);
++                     BN_num_bits(DH_get0_p(dh)), vhost_id, certfile);
++        DH_free(dh);
+     }
+ 
+ #ifdef HAVE_ECC
+@@ -1490,6 +1522,7 @@ static apr_status_t ssl_init_ticket_key(server_rec *s,
+     char buf[TLSEXT_TICKET_KEY_LEN];
+     char *path;
+     modssl_ticket_key_t *ticket_key = mctx->ticket_key;
++    int res;
+ 
+     if (!ticket_key->file_path) {
+         return APR_SUCCESS;
+@@ -1517,11 +1550,22 @@ static apr_status_t ssl_init_ticket_key(server_rec *s,
+     }
+ 
+     memcpy(ticket_key->key_name, buf, 16);
+-    memcpy(ticket_key->hmac_secret, buf + 16, 16);
+     memcpy(ticket_key->aes_key, buf + 32, 16);
+-
+-    if (!SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx,
+-                                          ssl_callback_SessionTicket)) {
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++    memcpy(ticket_key->hmac_secret, buf + 16, 16);
++    res = SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx,
++                                           ssl_callback_SessionTicket);
++#else
++    ticket_key->mac_params[0] =
++        OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, buf + 16, 16);
++    ticket_key->mac_params[1] =
++        OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, "sha256", 0);
++    ticket_key->mac_params[2] =
++        OSSL_PARAM_construct_end();
++    res = SSL_CTX_set_tlsext_ticket_key_evp_cb(mctx->ssl_ctx,
++                                               ssl_callback_SessionTicket);
++#endif
++    if (!res) {
+         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01913)
+                      "Unable to initialize TLS session ticket key callback "
+                      "(incompatible OpenSSL version?)");
+@@ -1652,7 +1696,7 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s,
+         return ssl_die(s);
+     }
+ 
+-    X509_STORE_load_locations(store, pkp->ca_cert_file, NULL);
++    modssl_X509_STORE_load_locations(store, pkp->ca_cert_file, NULL);
+ 
+     for (n = 0; n < ncerts; n++) {
+         int i;
+diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c
+index ed9db54..f7e5cfc 100644
+--- a/modules/ssl/ssl_engine_io.c
++++ b/modules/ssl/ssl_engine_io.c
+@@ -572,11 +572,20 @@ static int bio_filter_in_gets(BIO *bio, char *buf, int size)
+ 
+ static long bio_filter_in_ctrl(BIO *bio, int cmd, long num, void *ptr)
+ {
+-    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)(bio->ptr);
++    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
++    switch (cmd) {
++#ifdef BIO_CTRL_EOF
++    case BIO_CTRL_EOF:
++        return inctx->rc == APR_EOF;
++#endif
++    default:
++        break;
++    }
+     ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
+-                  "BUG: %s() should not be called", "bio_filter_in_ctrl");
++                  "BUG: bio_filter_in_ctrl() should not be called with cmd=%i",
++                  cmd);
+     AP_DEBUG_ASSERT(0);
+-    return -1;
++    return 0;
+ }
+ 
+ #if MODSSL_USE_OPENSSL_PRE_1_1_API
+@@ -601,7 +610,7 @@ static BIO_METHOD bio_filter_in_method = {
+     bio_filter_in_read,
+     bio_filter_in_puts,         /* puts is never called */
+     bio_filter_in_gets,         /* gets is never called */
+-    bio_filter_in_ctrl,         /* ctrl is never called */
++    bio_filter_in_ctrl,         /* ctrl is called for EOF check */
+     bio_filter_create,
+     bio_filter_destroy,
+     NULL
+diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
+index b99dcf1..f2d49ad 100644
+--- a/modules/ssl/ssl_engine_kernel.c
++++ b/modules/ssl/ssl_engine_kernel.c
+@@ -2614,7 +2614,11 @@ int ssl_callback_SessionTicket(SSL *ssl,
+                                unsigned char *keyname,
+                                unsigned char *iv,
+                                EVP_CIPHER_CTX *cipher_ctx,
+-                               HMAC_CTX *hctx,
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++                               HMAC_CTX *hmac_ctx,
++#else
++                               EVP_MAC_CTX *mac_ctx,
++#endif
+                                int mode)
+ {
+     conn_rec *c = (conn_rec *)SSL_get_app_data(ssl);
+@@ -2641,7 +2645,13 @@ int ssl_callback_SessionTicket(SSL *ssl,
+         }
+         EVP_EncryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL,
+                            ticket_key->aes_key, iv);
+-        HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL);
++
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++        HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16,
++                     tlsext_tick_md(), NULL);
++#else
++        EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params);
++#endif
+ 
+         ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02289)
+                       "TLS session ticket key for %s successfully set, "
+@@ -2662,7 +2672,13 @@ int ssl_callback_SessionTicket(SSL *ssl,
+ 
+         EVP_DecryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL,
+                            ticket_key->aes_key, iv);
+-        HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL);
++
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++        HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16,
++                     tlsext_tick_md(), NULL);
++#else
++        EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params);
++#endif
+ 
+         ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02290)
+                       "TLS session ticket key for %s successfully set, "
+diff --git a/modules/ssl/ssl_engine_log.c b/modules/ssl/ssl_engine_log.c
+index 7dbbbdb..3b3ceac 100644
+--- a/modules/ssl/ssl_engine_log.c
++++ b/modules/ssl/ssl_engine_log.c
+@@ -78,6 +78,16 @@ apr_status_t ssl_die(server_rec *s)
+     return APR_EGENERAL;
+ }
+ 
++static APR_INLINE
++unsigned long modssl_ERR_peek_error_data(const char **data, int *flags)
++{
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++    return ERR_peek_error_line_data(NULL, NULL, data, flags);
++#else
++    return ERR_peek_error_data(data, flags);
++#endif
++}
++
+ /*
+  * Prints the SSL library error information.
+  */
+@@ -87,7 +97,7 @@ void ssl_log_ssl_error(const char *file, int line, int level, server_rec *s)
+     const char *data;
+     int flags;
+ 
+-    while ((e = ERR_peek_error_line_data(NULL, NULL, &data, &flags))) {
++    while ((e = modssl_ERR_peek_error_data(&data, &flags))) {
+         const char *annotation;
+         char err[256];
+ 
+diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h
+index a6fc751..71d658c 100644
+--- a/modules/ssl/ssl_private.h
++++ b/modules/ssl/ssl_private.h
+@@ -89,6 +89,9 @@
+ /* must be defined before including ssl.h */
+ #define OPENSSL_NO_SSL_INTERN
+ #endif
++#if OPENSSL_VERSION_NUMBER >= 0x30000000
++#include <openssl/core_names.h>
++#endif
+ #include <openssl/ssl.h>
+ #include <openssl/err.h>
+ #include <openssl/x509.h>
+@@ -674,7 +677,11 @@ typedef struct {
+ typedef struct {
+     const char *file_path;
+     unsigned char key_name[16];
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+     unsigned char hmac_secret[16];
++#else
++    OSSL_PARAM mac_params[3];
++#endif
+     unsigned char aes_key[16];
+ } modssl_ticket_key_t;
+ #endif
+@@ -938,8 +945,16 @@ int          ssl_callback_ServerNameIndication(SSL *, int *, modssl_ctx_t *);
+ int          ssl_callback_ClientHello(SSL *, int *, void *);
+ #endif
+ #ifdef HAVE_TLS_SESSION_TICKETS
+-int         ssl_callback_SessionTicket(SSL *, unsigned char *, unsigned char *,
+-                                       EVP_CIPHER_CTX *, HMAC_CTX *, int);
++int ssl_callback_SessionTicket(SSL *ssl,
++                               unsigned char *keyname,
++                               unsigned char *iv,
++                               EVP_CIPHER_CTX *cipher_ctx,
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++                               HMAC_CTX *hmac_ctx,
++#else
++                               EVP_MAC_CTX *mac_ctx,
++#endif
++                               int mode);
+ #endif
+ 
+ #ifdef HAVE_TLS_ALPN
diff --git a/debian/patches/support-openssl3-003.patch b/debian/patches/support-openssl3-003.patch
 new file mode 100644
index 0000000..06906a9
--- /dev/null
+++ b/debian/patches/support-openssl3-003.patch
@@ -0,0 +1,48 @@
+From: Joe Orton <[e-mail]>
+Date: Mon, 26 Jul 2021 12:24:27 +0100
+Subject: mod_ssl: follow up to r1876934: wrap DH_bits()
+
+DH_get0_p() seems to be undefined for some openssl versions, so it can't
+be used to implement DH_bits() generically.
+
+Add new a modssl_DH_bits() wrapper to call DH_bits() for openssl < 3,
+and BN_num_bits(DH_get0_p(dh)) otherwise.
+
+Submitted by: ylavic
+
+
+Forwarded: yes, https://github.com/apache/httpd/pull/258
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1951476
+---
+ modules/ssl/ssl_engine_init.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index eb41e7f..a2da916 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -1271,6 +1271,15 @@ static int ssl_no_passwd_prompt_cb(char *buf, int size, int rwflag,
+    return 0;
+ }
+ 
++static APR_INLINE int modssl_DH_bits(DH *dh)
++{
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++    return DH_bits(dh);
++#else
++    return BN_num_bits(DH_get0_p(dh));
++#endif
++}
++
+ static apr_status_t ssl_init_server_certs(server_rec *s,
+                                           apr_pool_t *p,
+                                           apr_pool_t *ptemp,
+@@ -1470,7 +1479,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+         SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh);
+         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
+                      "Custom DH parameters (%d bits) for %s loaded from %s",
+-                     BN_num_bits(DH_get0_p(dh)), vhost_id, certfile);
++                     modssl_DH_bits(dh), vhost_id, certfile);
+         DH_free(dh);
+     }
+ 
diff --git a/debian/patches/support-openssl3-004.patch b/debian/patches/support-openssl3-004.patch
 new file mode 100644
index 0000000..5566eaf
--- /dev/null
+++ b/debian/patches/support-openssl3-004.patch
@@ -0,0 +1,56 @@
+From: Joe Orton <[e-mail]>
+Date: Mon, 26 Jul 2021 12:24:46 +0100
+Subject: * modules/ssl/ssl_engine_init.c (ssl_init_server_certs): Fix use of
+   encrypted private keys with OpenSSL 3.0.
+
+* test/travis_run_linux.sh: For TEST_SSL, test loading encrypted
+  private keys.
+
+Github: closes #{197}
+
+Submitted by: jorton
+
+
+Forwarded: yes, https://github.com/apache/httpd/pull/258
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1951476
+---
+ modules/ssl/ssl_engine_init.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index a2da916..2f3a120 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -1280,6 +1280,22 @@ static APR_INLINE int modssl_DH_bits(DH *dh)
+ #endif
+ }
+ 
++/* SSL_CTX_use_PrivateKey_file() can fail either because the private
++ * key was encrypted, or due to a mismatch between an already-loaded
++ * cert and the key - a common misconfiguration - from calling
++ * X509_check_private_key().  This macro is passed the last error code
++ * off the OpenSSL stack and evaluates to true only for the first
++ * case.  With OpenSSL < 3 the second case is identifiable by the
++ * function code, but function codes are not used from 3.0. */
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_FUNC(ec) != X509_F_X509_CHECK_PRIVATE_KEY)
++#else
++#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_LIB != ERR_LIB_X509            \
++                                 || (ERR_GET_REASON(ec) != X509_R_KEY_TYPE_MISMATCH \
++                                     && ERR_GET_REASON(ec) != X509_R_KEY_VALUES_MISMATCH \
++                                     && ERR_GET_REASON(ec) != X509_R_UNKNOWN_KEY_TYPE))
++#endif
++
+ static apr_status_t ssl_init_server_certs(server_rec *s,
+                                           apr_pool_t *p,
+                                           apr_pool_t *ptemp,
+@@ -1385,8 +1401,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+         }
+         else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
+                                               SSL_FILETYPE_PEM) < 1)
+-                 && (ERR_GET_FUNC(ERR_peek_last_error())
+-                     != X509_F_X509_CHECK_PRIVATE_KEY)) {
++                 && CHECK_PRIVKEY_ERROR(ERR_peek_last_error())) {
+             ssl_asn1_t *asn1;
+             const unsigned char *ptr;
+ 
diff --git a/debian/patches/support-openssl3-005.patch b/debian/patches/support-openssl3-005.patch
 new file mode 100644
index 0000000..5c6ebe8
--- /dev/null
+++ b/debian/patches/support-openssl3-005.patch
@@ -0,0 +1,121 @@
+From: Joe Orton <[e-mail]>
+Date: Mon, 26 Jul 2021 12:25:36 +0100
+Subject: mod_ssl: Switch to using OpenSSL's automatic internal DH parameter
+ generation from OpenSSL 1.1.0 and later.  The SSL_set_tmp_dh_callback() API
+ is deprecated from OpenSSL 3.0 onwards. Should not be a user-visible change
+ (except mod_ssl gets smaller).
+
+* modules/ssl/ssl_private.h,
+  modules/ssl/ssl_engine_kernel.c,
+  modules/ssl/ssl_engine_init.c (ssl_init_ctx_callbacks):
+  Drop internal DH parameter generation and callback for OpenSSL 1.1+,
+  use SSL_CTX_set_dh_auto(, 1) instead.
+
+Github: closes #188
+Reviewed by: rpluem
+
+Submitted by: jorton
+
+
+Forwarded: yes, https://github.com/apache/httpd/pull/258
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1951476
+---
+ modules/ssl/ssl_engine_init.c   | 14 ++++++++++----
+ modules/ssl/ssl_engine_kernel.c |  2 ++
+ modules/ssl/ssl_private.h       |  2 ++
+ 3 files changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index 2f3a120..d0ef4ba 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -91,7 +91,6 @@ static int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g)
+ 
+     return 1;
+ }
+-#endif
+ 
+ /*
+  * Grab well-defined DH parameters from OpenSSL, see the BN_get_rfc*
+@@ -171,6 +170,7 @@ DH *modssl_get_dh_params(unsigned keylen)
+         
+     return NULL; /* impossible to reach. */
+ }
++#endif
+ 
+ static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf,
+                                        server_rec *s)
+@@ -440,8 +440,9 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog,
+ 
+     modssl_init_app_data2_idx(); /* for modssl_get_app_data2() at request time */
+ 
++#if MODSSL_USE_OPENSSL_PRE_1_1_API
+     init_dh_params();
+-#if !MODSSL_USE_OPENSSL_PRE_1_1_API
++#else
+     init_bio_methods();
+ #endif
+ 
+@@ -834,7 +835,11 @@ static void ssl_init_ctx_callbacks(server_rec *s,
+ {
+     SSL_CTX *ctx = mctx->ssl_ctx;
+ 
++#if MODSSL_USE_OPENSSL_PRE_1_1_API
+     SSL_CTX_set_tmp_dh_callback(ctx,  ssl_callback_TmpDH);
++#else
++    SSL_CTX_set_dh_auto(ctx, 1);
++#endif
+ 
+     SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
+ 
+@@ -2317,10 +2322,11 @@ apr_status_t ssl_init_ModuleKill(void *data)
+ 
+     }
+ 
+-#if !MODSSL_USE_OPENSSL_PRE_1_1_API
++#if MODSSL_USE_OPENSSL_PRE_1_1_API
++    free_dh_params();
++#else
+     free_bio_methods();
+ #endif
+-    free_dh_params();
+ 
+     return APR_SUCCESS;
+ }
+diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
+index f2d49ad..aced92d 100644
+--- a/modules/ssl/ssl_engine_kernel.c
++++ b/modules/ssl/ssl_engine_kernel.c
+@@ -1685,6 +1685,7 @@ const authz_provider ssl_authz_provider_verify_client =
+ **  _________________________________________________________________
+ */
+ 
++#if MODSSL_USE_OPENSSL_PRE_1_1_API
+ /*
+  * Hand out standard DH parameters, based on the authentication strength
+  */
+@@ -1730,6 +1731,7 @@ DH *ssl_callback_TmpDH(SSL *ssl, int export, int keylen)
+ 
+     return modssl_get_dh_params(keylen);
+ }
++#endif
+ 
+ /*
+  * This OpenSSL callback function is called when OpenSSL
+diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h
+index 71d658c..b74d956 100644
+--- a/modules/ssl/ssl_private.h
++++ b/modules/ssl/ssl_private.h
+@@ -1127,10 +1127,12 @@ void ssl_init_ocsp_certificates(server_rec *s, modssl_ctx_t *mctx);
+ 
+ #endif
+ 
++#if MODSSL_USE_OPENSSL_PRE_1_1_API
+ /* Retrieve DH parameters for given key length.  Return value should
+  * be treated as unmutable, since it is stored in process-global
+  * memory. */
+ DH *modssl_get_dh_params(unsigned keylen);
++#endif
+ 
+ /* Returns non-zero if the request was made over SSL/TLS.  If sslconn
+  * is non-NULL and the request is using SSL/TLS, sets *sslconn to the
diff --git a/debian/patches/support-openssl3-006.patch b/debian/patches/support-openssl3-006.patch
 new file mode 100644
index 0000000..33e0c1f
--- /dev/null
+++ b/debian/patches/support-openssl3-006.patch
@@ -0,0 +1,33 @@
+From: Joe Orton <[e-mail]>
+Date: Mon, 26 Jul 2021 12:29:32 +0100
+Subject: fix build with LibreSSL [Yann Ylavic] Github issue #188
+
+Submitted by: gbechis
+
+
+Forwarded: yes, https://github.com/apache/httpd/pull/258
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1951476
+---
+ modules/ssl/ssl_private.h | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h
+index b74d956..b091c58 100644
+--- a/modules/ssl/ssl_private.h
++++ b/modules/ssl/ssl_private.h
+@@ -137,13 +137,12 @@
+         SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL)
+ #define SSL_CTX_set_max_proto_version(ctx, version) \
+         SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL)
+-#elif LIBRESSL_VERSION_NUMBER < 0x2070000f
++#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */
+ /* LibreSSL before 2.7 declares OPENSSL_VERSION_NUMBER == 2.0 but does not
+  * include most changes from OpenSSL >= 1.1 (new functions, macros, 
+  * deprecations, ...), so we have to work around this...
+  */
+-#define MODSSL_USE_OPENSSL_PRE_1_1_API (1)
+-#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */
++#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f)
+ #else /* defined(LIBRESSL_VERSION_NUMBER) */
+ #define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L)
+ #endif
diff --git a/debian/patches/support-openssl3-007.patch b/debian/patches/support-openssl3-007.patch
 new file mode 100644
index 0000000..6f760b8
--- /dev/null
+++ b/debian/patches/support-openssl3-007.patch
@@ -0,0 +1,72 @@
+From: Joe Orton <[e-mail]>
+Date: Mon, 26 Jul 2021 14:15:28 +0100
+Subject: Support for OpenSSL 1.1.0: - BIO was made opaque after OpenSSL
+ 1.1.0pre4.
+
+Submitted by: rjung
+
+
+Forwarded: yes, https://github.com/apache/httpd/pull/258
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1951476
+---
+ modules/ssl/ssl_engine_io.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c
+index f7e5cfc..3db7077 100644
+--- a/modules/ssl/ssl_engine_io.c
++++ b/modules/ssl/ssl_engine_io.c
+@@ -194,7 +194,7 @@ static int bio_filter_destroy(BIO *bio)
+ static int bio_filter_out_read(BIO *bio, char *out, int outl)
+ {
+     /* this is never called */
+-    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)(bio->ptr);
++    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
+     ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
+                   "BUG: %s() should not be called", "bio_filter_out_read");
+     AP_DEBUG_ASSERT(0);
+@@ -297,7 +297,7 @@ static long bio_filter_out_ctrl(BIO *bio, int cmd, long num, void *ptr)
+ static int bio_filter_out_gets(BIO *bio, char *buf, int size)
+ {
+     /* this is never called */
+-    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)(bio->ptr);
++    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
+     ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
+                   "BUG: %s() should not be called", "bio_filter_out_gets");
+     AP_DEBUG_ASSERT(0);
+@@ -307,7 +307,7 @@ static int bio_filter_out_gets(BIO *bio, char *buf, int size)
+ static int bio_filter_out_puts(BIO *bio, const char *str)
+ {
+     /* this is never called */
+-    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)(bio->ptr);
++    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
+     ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
+                   "BUG: %s() should not be called", "bio_filter_out_puts");
+     AP_DEBUG_ASSERT(0);
+@@ -545,7 +545,7 @@ static int bio_filter_in_read(BIO *bio, char *in, int inlen)
+ 
+ static int bio_filter_in_write(BIO *bio, const char *in, int inl)
+ {
+-    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)(bio->ptr);
++    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
+     ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
+                   "BUG: %s() should not be called", "bio_filter_in_write");
+     AP_DEBUG_ASSERT(0);
+@@ -554,7 +554,7 @@ static int bio_filter_in_write(BIO *bio, const char *in, int inl)
+ 
+ static int bio_filter_in_puts(BIO *bio, const char *str)
+ {
+-    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)(bio->ptr);
++    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
+     ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
+                   "BUG: %s() should not be called", "bio_filter_in_puts");
+     AP_DEBUG_ASSERT(0);
+@@ -563,7 +563,7 @@ static int bio_filter_in_puts(BIO *bio, const char *str)
+ 
+ static int bio_filter_in_gets(BIO *bio, char *buf, int size)
+ {
+-    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)(bio->ptr);
++    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
+     ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
+                   "BUG: %s() should not be called", "bio_filter_in_gets");
+     AP_DEBUG_ASSERT(0);
diff --git a/debian/patches/support-openssl3-008.patch b/debian/patches/support-openssl3-008.patch
 new file mode 100644
index 0000000..d04497f
--- /dev/null
+++ b/debian/patches/support-openssl3-008.patch
@@ -0,0 +1,29 @@
+From: Joe Orton <[e-mail]>
+Date: Wed, 28 Jul 2021 12:28:59 +0100
+Subject: mod_ssl: follow up to r1876934: fix
+ !modssl_X509_STORE_load_locations() logic.
+
+Submitted by: ylavic
+
+
+Forwarded: yes, https://github.com/apache/httpd/pull/258
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1951476
+---
+ modules/ssl/ssl_engine_init.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index d0ef4ba..5d199cd 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -1046,8 +1046,8 @@ static apr_status_t ssl_init_ctx_crl(server_rec *s,
+     ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900)
+                  "Configuring certificate revocation facility");
+ 
+-    if (!store || modssl_X509_STORE_load_locations(store, mctx->crl_file,
+-                                                          mctx->crl_path)) {
++    if (!store || !modssl_X509_STORE_load_locations(store, mctx->crl_file,
++                                                           mctx->crl_path)) {
+         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901)
+                      "Host %s: unable to configure X.509 CRL storage "
+                      "for certificate revocation", mctx->sc->vhost_id);
diff --git a/debian/patches/support-openssl3-009.patch b/debian/patches/support-openssl3-009.patch
 new file mode 100644
index 0000000..01687e9
--- /dev/null
+++ b/debian/patches/support-openssl3-009.patch
@@ -0,0 +1,36 @@
+From: Joe Orton <[e-mail]>
+Date: Mon, 4 Oct 2021 14:26:49 +0100
+Subject: * modules/ssl/ssl_engine_init.c (ssl_init_server_certs): For OpenSSL
+   1.1+,
+ disable auto DH parameter selection if parameters have been   manually
+ configured.  This fixes a regression in r1890067 after   which manually
+ configured parameters are ignored.
+
+Submitted by: jorton
+
+
+Forwarded: yes, https://github.com/apache/httpd/pull/258
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1951476
+---
+ modules/ssl/ssl_engine_init.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index 5d199cd..3986ba7 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -1496,7 +1496,14 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+     certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *);
+     if (certfile && !modssl_is_engine_id(certfile)
+         && (dh = ssl_dh_GetParamFromFile(certfile))) {
++        /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey()
++         * for OpenSSL 3.0+. */
+         SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh);
++#if !MODSSL_USE_OPENSSL_PRE_1_1_API
++        /* OpenSSL ignores manually configured DH params if automatic
++         * selection if enabled, so disable auto selection here. */
++        SSL_CTX_set_dh_auto(mctx->ssl_ctx, 0);
++#endif
+         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
+                      "Custom DH parameters (%d bits) for %s loaded from %s",
+                      modssl_DH_bits(dh), vhost_id, certfile);
diff --git a/debian/patches/support-openssl3-010.patch b/debian/patches/support-openssl3-010.patch
 new file mode 100644
index 0000000..2791e96
--- /dev/null
+++ b/debian/patches/support-openssl3-010.patch
@@ -0,0 +1,54 @@
+From: Joe Orton <[e-mail]>
+Date: Tue, 12 Oct 2021 13:48:55 +0100
+Subject: * modules/ssl/ssl_engine_init.c (ssl_init_ctx_callbacks,
+   ssl_init_server_certs): Flip logic for enabling/disabling DH auto
+   parameter selection for OpenSSL 1.1+ to be simpler and consistent   with
+ auto ECDH curve selection.
+
+
+Forwarded: yes, https://github.com/apache/httpd/pull/258
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1951476
+---
+ modules/ssl/ssl_engine_init.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index 3986ba7..f440a37 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -836,9 +836,9 @@ static void ssl_init_ctx_callbacks(server_rec *s,
+     SSL_CTX *ctx = mctx->ssl_ctx;
+ 
+ #if MODSSL_USE_OPENSSL_PRE_1_1_API
++    /* Note that for OpenSSL>=1.1, auto selection is enabled via
++     * SSL_CTX_set_dh_auto(,1) if no parameter is configured. */
+     SSL_CTX_set_tmp_dh_callback(ctx,  ssl_callback_TmpDH);
+-#else
+-    SSL_CTX_set_dh_auto(ctx, 1);
+ #endif
+ 
+     SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
+@@ -1499,16 +1499,18 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+         /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey()
+          * for OpenSSL 3.0+. */
+         SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh);
+-#if !MODSSL_USE_OPENSSL_PRE_1_1_API
+-        /* OpenSSL ignores manually configured DH params if automatic
+-         * selection if enabled, so disable auto selection here. */
+-        SSL_CTX_set_dh_auto(mctx->ssl_ctx, 0);
+-#endif
+         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
+                      "Custom DH parameters (%d bits) for %s loaded from %s",
+                      modssl_DH_bits(dh), vhost_id, certfile);
+         DH_free(dh);
+     }
++#if !MODSSL_USE_OPENSSL_PRE_1_1_API
++    else {
++        /* If no parameter is manually configured, enable auto
++         * selection. */
++        SSL_CTX_set_dh_auto(mctx->ssl_ctx, 1);
++    }
++#endif
+ 
+ #ifdef HAVE_ECC
+     /*
diff --git a/debian/source/include-binaries b/debian/source/include-binaries
index d617b1d..823d9c0 100644
--- a/debian/source/include-binaries
+++ b/debian/source/include-binaries
@@ -17,6 +17,7 @@ debian/icons/odf6otp-20x22.png
 debian/icons/odf6ots-20x22.png
 debian/icons/odf6ott-20x22.png
 debian/icons/openlogo-75.png
+debian/icons/ubuntu-logo.png
 debian/perl-framework/t/htdocs/apache/acceptpathinfo/index.shtml
 debian/perl-framework/t/htdocs/apache/acceptpathinfo/info.php
 debian/perl-framework/t/htdocs/apache/acceptpathinfo/off/index.shtml