Flag this a bit more clearly as a security issue...

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@94720 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/src/CHANGES b/src/CHANGES
index eada8612136442e86f70043aa536f1a000926840..9d61ac9ea38732453e37bbb39a02d1277428603f 100644 (file)
--- a/src/CHANGES
+++ b/src/CHANGES
@@ -34,7 +34,8 @@ Changes with Apache 1.3.24
   *) Fixed a segfault in mod_include when #if, #elif, #else, or #endif
      directives were improperly terminated.  [Cliff Woolley]
 
-  *) Introduce proper escaping of command.com and cmd.exe for Win32.
+  *) Win32 Security: CAN-2002-0061
+     Introduce proper escaping of command.com and cmd.exe for Win32.
      These patches close vulnerability CAN-2002-0061, identified and
      reported by Ory Segal <ory.segal@sanctuminc>, by which any CGI
      invocation of .bat or .cmd files could compromise the system