Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Subject: RE: mod_ssl fix for PR# 27106
Date: Tue, 9 Mar 2004 08:28:03 -0800
Message-ID: 
 <E830E4A78E28F3439B2CA005CC26DDEF5B2A6E@USCUS-MAIL01.amer.borl.net>
Thread-Topic: mod_ssl fix for PR# 27106
Thread-Index: AcQF4OMlHsPKY5xjQySWowiNFONLnAAEoOug
From: "Andy Cutright" <Andy.Cutright@borland.com>
To: "Joe Orton" <jorton@redhat.com>
Cc: <dev@httpd.apache.org>

thanks,

andy =20

> -----Original Message-----
> From: Joe Orton [mailto:jorton@redhat.com]=20
> Sent: Tuesday, March 09, 2004 6:14 AM
> To: Andy Cutright
> Cc: dev@httpd.apache.org
> Subject: Re: mod_ssl fix for PR# 27106
>=20
> On Mon, Mar 08, 2004 at 02:47:10PM -0800, Andy Cutright wrote:
> > apacheweek has announced a vulnerability:
> >=20
> > http://www.apacheweek.com/features/security-20
> >=20
> > the bugzilla problem report indicates this diff fixes the problem:=20
> >=20
> >=20
> http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_en
> gine_io.c?
> > r1=3D1.117&r2=3D1.118
> >=20
> > recent email on the dev list includes -two- diffs under the=20
> PR report:=20
> ...
> > can someone please tell me if i need both of the patches or=20
> only one? if
> > i need both patches, is the bugzilla report wrong? my=20
> source code base
> > is the 2.0.48 release.=20
>=20
> Use both the patches or just fetch the backported patch which includes
> both changes:
>=20
> http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_en
> gine_io.c?r1=3D1.100.2.11&r2=3D1.100.2.12
>=20
> joe
>=20