Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of dirkx@webweaving.org designates
 178.18.23.51 as permitted sender)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Apple Message framework v1244.3)
Subject: Re: Next update
From: Dirk-WIllem van Gulik <dirkx@webweaving.org>
In-Reply-To: <0F87A257-274D-4803-B9B4-996203B85CDA@webweaving.org>
Date: Wed, 31 Aug 2011 21:07:26 +0100
Content-Transfer-Encoding: quoted-printable
Message-Id: <5F70EDB6-9189-4D10-BE4B-73601062EF1D@webweaving.org>
References: <42A9210B-B11F-4771-957E-BC6DC6886BCB@webweaving.org>
 <F0328A02-507F-42F6-A99E-EC2F30733BB7@bbc.co.uk>
 <4E57CB51.7070804@apache.org>
 <00AC7C77-66BA-4E27-A919-1D1766A39C1B@webweaving.org>
 <CALK=YjMh7+8qTS-s3s3zkcGPDc_wjKhPzTT_jYu15Uwv_G8CgA@mail.gmail.com>
 <4E57D272.9010208@rowe-clan.net>
 <B5B7FBAF-89EA-428F-84D2-4BBB18837730@webweaving.org>
 <0F87A257-274D-4803-B9B4-996203B85CDA@webweaving.org>
To: dev@httpd.apache.org


On 31 Aug 2011, at 21:03, Dirk-WIllem van Gulik wrote:

> Suggestion for
>=20
> 	http://people.apache.org/~dirkx/CVE-2011-3192.txt
>=20
> to be sent to announce and the usual security places.
>=20
> ->	Comments on weaken/strenghten 1.3 text
>=20
> 	Happy to completely recant that it was vulnerable. Or happy to =
keep a bit of a warning in there.
>=20
> ->	Lots of small tweaks.
>=20
> ->	Do we leave the 200/206 chunked/full range caveats in - or is =
that no longer the case ?
>=20
> Thanks,

Ah - before I forget - also fine to not do it this heavy handed - but to =
sent Jim his message to users/devs@ to these security places as well.

But am slightly biased to towards an advisory of this size - as it helps =
admins in large organizations negotiate priorities with their ops teams, =
bosses and others.

Dw.=