You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by yl...@apache.org on 2016/12/05 23:50:17 UTC
svn commit: r1772814 - /httpd/httpd/branches/2.4.x/STATUS
Author: ylavic
Date: Mon Dec 5 23:50:17 2016
New Revision: 1772814
URL: http://svn.apache.org/viewvc?rev=1772814&view=rev
Log:
Propose mod_session_crypto fix for CVE-2016-0736.
Modified:
httpd/httpd/branches/2.4.x/STATUS
Modified: httpd/httpd/branches/2.4.x/STATUS
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/STATUS?rev=1772814&r1=1772813&r2=1772814&view=diff
==============================================================================
--- httpd/httpd/branches/2.4.x/STATUS (original)
+++ httpd/httpd/branches/2.4.x/STATUS Mon Dec 5 23:50:17 2016
@@ -149,7 +149,6 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK:
jailletc36: compatibility note missing in the XML file
jim: Will address during commit
-
*) mod_lua: Fix default value of LuaInherit directive. It should be
'parent-first' instead of 'none', as per documentation. PR 60419
trunk patch: http://svn.apache.org/r1772489
@@ -157,6 +156,16 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK:
2.4.x patch: trunk works
+1: jailletc36, jim
+ *) SECURITY: CVE-2016-0736 (cve.mitre.org)
+ mod_session_crypto: Authenticate the session data/cookie with a
+ MAC (SipHash) to prevent deciphering or tampering from a padding
+ oracle attack. [Yann Ylavic, Colm MacCarthaigh]
+ trunk patch: http://svn.apache.org/r1772812
+ http://svn.apache.org/r1772813
+ 2.4.x patch: trunk works (modulo CHANGES)
+ +1: ylavic
+
+
PATCHES/ISSUES THAT ARE BEING WORKED
[ New entried should be added at the START of the list ]