From: Jim Jagielski Date: Tue, 6 Dec 2016 17:36:26 +0000 (+0000) Subject: promote X-Git-Tag: 2.4.24~65 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ad46b260f572f8432090b7f39ee5a6c15aaead3e;p=apache promote git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1772924 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/STATUS b/STATUS index a222632b05..28f9a289be 100644 --- a/STATUS +++ b/STATUS @@ -117,6 +117,14 @@ RELEASE SHOWSTOPPERS: PATCHES ACCEPTED TO BACKPORT FROM TRUNK: [ start all new proposals below, under PATCHES PROPOSED. ] + *) SECURITY: CVE-2016-0736 (cve.mitre.org) + mod_session_crypto: Authenticate the session data/cookie with a + MAC (SipHash) to prevent deciphering or tampering from a padding + oracle attack. [Yann Ylavic, Colm MacCarthaigh] + trunk patch: http://svn.apache.org/r1772812 + http://svn.apache.org/r1772813 + 2.4.x patch: trunk works (modulo CHANGES) + +1: ylavic, covener, jim PATCHES PROPOSED TO BACKPORT FROM TRUNK: @@ -149,14 +157,6 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK: jailletc36: compatibility note missing in the XML file jim: Will address during commit - *) SECURITY: CVE-2016-0736 (cve.mitre.org) - mod_session_crypto: Authenticate the session data/cookie with a - MAC (SipHash) to prevent deciphering or tampering from a padding - oracle attack. [Yann Ylavic, Colm MacCarthaigh] - trunk patch: http://svn.apache.org/r1772812 - http://svn.apache.org/r1772813 - 2.4.x patch: trunk works (modulo CHANGES) - +1: ylavic, covener, jim PATCHES/ISSUES THAT ARE BEING WORKED