Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of jorton@redhat.com designates
 66.187.237.31 as permitted sender)
Date: Mon, 6 Jul 2009 09:51:39 +0100
From: Joe Orton <jorton@redhat.com>
To: dev@httpd.apache.org
Subject: Re: svn commit: r790587 - in /httpd/httpd/trunk: CHANGES
	modules/proxy/mod_proxy_http.c
Message-ID: <20090706085139.GA6059@redhat.com>
Mail-Followup-To: dev@httpd.apache.org
References: <20090702134118.8F74B238888E@eris.apache.org>
 <4A4FD672.5070305@webthing.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <4A4FD672.5070305@webthing.com>
User-Agent: Mutt/1.5.18 (2008-05-17)
Organization: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor,
 Berkshire, SL4 1TE, United Kingdom.
  Registered in UK and Wales under Company Registration No. 03798903
  Directors: Michael Cunningham (USA), Brendan Lane (Ireland),
 Matt Parson (USA), Charlie Peters (USA)

On Sat, Jul 04, 2009 at 11:23:46PM +0100, Nick Kew wrote:
> jorton@apache.org wrote:
>
>>  Changes with Apache 2.3.3
>>  +  *) SECURITY: CVE-2009-1890 (cve.mitre.org) +     Fix a potential 
>> Denial-of-Service attack against mod_proxy in a
>> +     reverse proxy configuration, where a remote attacker can force a
>> +     proxy process to consume CPU time indefinitely.  [Nick Kew, Joe Orton]
>
> I thought in this instance, the original reporter's diagnostic
> work contributed more to the patch than we did.  I think he
> should be credited in the changelog here.

Lots of people help out with diagnosis of many bugs, we typically credit 
in CHANGES only those who came up with the patches.  I certainly should 
have given credit to the reporter in the commit message though, I will 
fix that.

Regards, Joe