PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
[ start all new proposals below, under PATCHES PROPOSED. ]
+ *) SECURITY: CVE-2016-0736 (cve.mitre.org)
+ mod_session_crypto: Authenticate the session data/cookie with a
+ MAC (SipHash) to prevent deciphering or tampering from a padding
+ oracle attack. [Yann Ylavic, Colm MacCarthaigh]
+ trunk patch: http://svn.apache.org/r1772812
+ http://svn.apache.org/r1772813
+ 2.4.x patch: trunk works (modulo CHANGES)
+ +1: ylavic, covener, jim
PATCHES PROPOSED TO BACKPORT FROM TRUNK:
jailletc36: compatibility note missing in the XML file
jim: Will address during commit
- *) SECURITY: CVE-2016-0736 (cve.mitre.org)
- mod_session_crypto: Authenticate the session data/cookie with a
- MAC (SipHash) to prevent deciphering or tampering from a padding
- oracle attack. [Yann Ylavic, Colm MacCarthaigh]
- trunk patch: http://svn.apache.org/r1772812
- http://svn.apache.org/r1772813
- 2.4.x patch: trunk works (modulo CHANGES)
- +1: ylavic, covener, jim
PATCHES/ISSUES THAT ARE BEING WORKED