From 633a12126d456489ccccfd0bdbc2bffb57e30083 Mon Sep 17 00:00:00 2001 From: Yann Ylavic Date: Mon, 17 Jul 2017 10:32:45 +0000 Subject: [PATCH] Add CHANGES' security entries for 2.4.27. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1802121 13f79535-47bb-0310-9956-ffa450edef68 --- CHANGES | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/CHANGES b/CHANGES index 3578665e08b..3e443781a9b 100644 --- a/CHANGES +++ b/CHANGES @@ -5,6 +5,16 @@ Changes with Apache 2.4.28 Changes with Apache 2.4.27 + *) SECURITY: CVE-2017-9789 (cve.mitre.org) + mod_http2: Read after free. When under stress, closing many connections, + the HTTP/2 handling code would sometimes access memory after it has been + freed, resulting in potentially erratic behaviour. + + *) SECURITY: CVE-2017-9788 (cve.mitre.org) + mod_auth_digest: Uninitialized memory reflection. The value placeholder + in [Proxy-]Authorization headers type 'Digest' was not initialized or + reset before or between successive key=value assignments. + *) COMPATIBILITY: mod_lua: Remove the undocumented exported 'apr_table' global variable when using Lua 5.2 or later. This was exported as a side effect from luaL_register, which is no longer supported as of -- 2.47.2