how to compare HP apache version number vs. generic apache?

[abc_18]

According to apache.org, the latest version (with the most security fixes) of apache in the 2.0.x stream is version 2.0.63 (Ref: http://httpd.apache.org )

However the most recent version offered by HP-UX appears to be way behind, ie, "2.0.59.15"

(Ref: http://www.securityfocus.com/archive/1/511631/30/210/threaded )

Q#1: is HP's "2.0.59.15" comparable to the (ancient) Apache.org "2.0.59", or does HP's odd ".15" suffix mean it's somehow newer?

Q#2: what Apache.org version is "2.0.59.15" comparable to? Is it "2.0.63"?

Q#3: is "2.0.59.15" the latest and greatest version available for HP-UX?

Q#4: why does HP use such a bizarre versioning scheme?

Thanks in advance.

PS. I'd prefer to just use the vanilla apache (from apache.org), but our company's policy is to use the version distributed by HP.

[Duncan Edmonstone · Accepted solution]

I can't answre everything defintively, but I'll tell you what I know...

>> Q#1: is HP's "2.0.59.15" comparable to the (ancient) Apache.org "2.0.59", or does HP's odd ".15" suffix mean it's somehow newer?

Yes it's newer in that it has plenty more security vulnerabilities fixed than the vanilla 2.0.59 had...

>> Q#2: what Apache.org version is "2.0.59.15" comparable to? Is it "2.0.63"?

- It's "based" on 2.0.59, but has all the security fixes in it right up to 2.0.63. You can search for when any given security fix was added by entering the CVE number for the vulnerability in the search tool at software.hp.com. For exactly what is in the latest version see here:

https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXWSATW231


>> Q#3: is "2.0.59.15" the latest and greatest version available for HP-UX?

If that's the last version available at software.hp.com, then yes.

>> Q#4: why does HP use such a bizarre versioning scheme?

I don't know... but I do know onme of the reasons for still having these older versions is to maintain compatability with Systems Management Homepage, which depends on Apache 2.0.x... I guess the response is, if you want a newer version, you can roll your own, or get copies from hpux.connect.org.uk

HTH

Duncan