From: Eric Covener Date: Wed, 16 Jul 2014 00:37:07 +0000 (+0000) Subject: vote/promote X-Git-Tag: 2.2.28~48 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ebddb5b7b65f78237af5a5f4be32dc05fac4e27d;p=thirdparty%2Fapache%2Fhttpd.git vote/promote git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1610888 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/STATUS b/STATUS index 138307c0761..fe553a29bfc 100644 --- a/STATUS +++ b/STATUS @@ -110,10 +110,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK: *) mod_dav: Fix improper encoding in PROPFIND responses. PR 56480. +1: breser, rpluem, ylavic - -PATCHES PROPOSED TO BACKPORT FROM TRUNK: - [ New proposals should be added at the end of the list ] - * SECURITY: CVE-2014-0231 mod_cgid: Fix a denial of service against CGI scripts that do not consume stdin that could lead to lingering HTTPD child processes @@ -125,6 +121,20 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK: 2.2.x patch: http://people.apache.org/~covener/patches/httpd-2.2.x-cgid-script_timeout.diff +1: covener, trawick, ylavic + * mod_ssl: Extend the scope of SSLSessionCacheTimeout to sessions + resumed by TLS session resumption (RFC 5077). + trunk patch: http://svn.apache.org/r1610311 + 2.4.x patch: Trunk patch works modulo CHANGES + and compatibility note. + 2.2.x patch: http://people.apache.org/~rjung/patches/mod_ssl_session_resumption_timeout-2.2.patch + +1: rjung, ylavic, covener + + + +PATCHES PROPOSED TO BACKPORT FROM TRUNK: + [ New proposals should be added at the end of the list ] + + * SECURITY: CVE-2014-0118 (cve.mitre.org) mod_deflate: The DEFLATE input filter (inflates request bodies) now limits the length and compression ratio of inflated request bodies to avoid @@ -192,14 +202,6 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK: (modulo CHANGES) +1: ylavic, breser - * mod_ssl: Extend the scope of SSLSessionCacheTimeout to sessions - resumed by TLS session resumption (RFC 5077). - trunk patch: http://svn.apache.org/r1610311 - 2.4.x patch: Trunk patch works modulo CHANGES - and compatibility note. - 2.2.x patch: http://people.apache.org/~rjung/patches/mod_ssl_session_resumption_timeout-2.2.patch - +1: rjung, ylavic - *) core: Detect incomplete request and response bodies, log an error and forward it to the underlying filters. PR 55475 [Yann Ylavic] trunk patch: http://svn.apache.org/r1538776