From: Yann Ylavic <ylavic@apache.org>
Date: Mon, 17 Jul 2017 10:32:45 +0000 (+0000)
Subject: Add CHANGES' security entries for 2.4.27.
X-Git-Tag: 2.4.28~110
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=633a12126d456489ccccfd0bdbc2bffb57e30083;p=thirdparty%2Fapache%2Fhttpd.git

Add CHANGES' security entries for 2.4.27.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1802121 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index 3578665e08b..3e443781a9b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5,6 +5,16 @@ Changes with Apache 2.4.28
 
 Changes with Apache 2.4.27
 
+  *) SECURITY: CVE-2017-9789 (cve.mitre.org)
+     mod_http2: Read after free. When under stress, closing many connections,
+     the HTTP/2 handling code would sometimes access memory after it has been
+     freed, resulting in potentially erratic behaviour. 
+
+  *) SECURITY: CVE-2017-9788 (cve.mitre.org)
+     mod_auth_digest: Uninitialized memory reflection.  The value placeholder
+     in [Proxy-]Authorization headers type 'Digest' was not initialized or
+     reset before or between successive key=value assignments.
+
   *) COMPATIBILITY: mod_lua: Remove the undocumented exported 'apr_table'
      global variable when using Lua 5.2 or later. This was exported as a
      side effect from luaL_register, which is no longer supported as of