add entry for r1179239 (CVE-2011-3368)

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1233611 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 713d756e3b7e7c9381f3a9a1f27dccc64382453a..575b148527aa51fb9e1ceb4c4215b20c650e21ac 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -153,6 +153,11 @@ Changes with Apache 2.3.15
      core: Fix integer overflow in ap_pregsub. This can be triggered e.g.
      with mod_setenvif via a malicious .htaccess. [Stefan Fritsch]
 
+  *) SECURITY: CVE-2011-3368 (cve.mitre.org)
+     Reject requests where the request-URI does not match the HTTP
+     specification, preventing unexpected expansion of target URLs in
+     some reverse proxy configurations.  [Joe Orton]
+
   *) configure: Load all modules in the generated default configuration
      when using --enable-load-all-modules. [Rainer Jung]