Reference CVS id

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@94724 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/src/CHANGES b/src/CHANGES
index 16b4a3e04eb83ddb4787f65459ba86aff90b6e54..b1426f2e3b1dcea6c82faa8746fe45696994bf01 100644 (file)
--- a/src/CHANGES
+++ b/src/CHANGES
@@ -1023,7 +1023,7 @@ Changes with Apache 1.3.13 [not released]
      tree, and other minor MPE tweaks.  
      [Mark Bixby <mark_bixby@hp.com>]
 
-  *) Tighten up the syntax checking of Host: headers to fix a
+  *) Security: Tighten up the syntax checking of Host: headers to fix a
      security bug in some mass virtual hosting configurations
      that can allow a remote attacker to retrieve some files
      on the system that should be inaccessible. [Tony Finch]
@@ -1036,7 +1036,8 @@ Changes with Apache 1.3.13 [not released]
      SHA1 and plaintext password encodings.  Make feature tests a
      bit more flexible.  [William Rowe]
 
-  *) Fix a security problem that affects some configurations of
+  *) Security: CVE-2000-0913
+     Fix a security problem that affects some configurations of
      mod_rewrite. If the result of a RewriteRule is a filename that
      contains expansion specifiers, especially regexp backreferences
      $0..$9 and %0..%9, then it may have been possible for an attacker