2902 is a security bug

bk: 5612590bsxxL86zdxwgjvTGftv-lpQ

diff --git a/ChangeLog b/ChangeLog
index 4bf945f8d995ea90b6dae41f06c20b196ad554bf..bc636294b92b42f8d9a1b6d672f5ed165635c40b 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,6 @@
 ---
+* [Sec 2902] configuration directives "pidfile" and "driftfile"
+  should be local-only. perlinger@ntp.org (patch by Miroslav Lichvar)
 * [Bug 2332] (reopened) Exercise thread cancellation once before dropping
   privileges and limiting resources in NTPD removes the need to link
   forcefully against 'libgcc_s' which does not always work. J.Perlinger
@@ -22,8 +24,6 @@
 * [Bug 2888] streamline calendar functions.  perlinger@ntp.org
 * [Bug 2889] ntp-dev-4.3.67 does not build on Windows.  perlinger@ntp.org
 * [Bug 2890] Ignore ENOBUFS on routing netlink socket.  Konstantin Khlebnikov.
-* [Bug 2902] configuration directives "pidfile" and "driftfile"
-  should be local-only. perlinger@ntp.org (patch by Miroslav Lichvar)
 * [Bug 2906] make check needs better support for pthreads.  Harlan Stenn.
 * [Bug 2907] dist* build targets require our libevent/ to be enabled.  HStenn.
 * [Bug 2912] no munlockall() under Windows.  David Taylor, Harlan Stenn.