Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of covener@gmail.com designates
 209.85.220.176 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAKUrXK5cmc2eEx37yU9D_si=TtRaz2nv8nTuGiWoMwho=t1KMw@mail.gmail.com>
References: 
 <CAKUrXK5cmc2eEx37yU9D_si=TtRaz2nv8nTuGiWoMwho=t1KMw@mail.gmail.com>
Date: Mon, 14 Jul 2014 20:36:28 -0400
Message-ID: 
 <CALK=YjN427fdj=OvrWwzeVE3Xkyo06_YKwDPZid9PqLNyStuAw@mail.gmail.com>
Subject: Re: [PATCH] did I understand the mod_cgid fix properly?
From: Eric Covener <covener@gmail.com>
To: Apache HTTP Server Development List <dev@httpd.apache.org>
Content-Type: text/plain; charset=UTF-8

On Mon, Jul 14, 2014 at 5:18 PM, Jeff Trawick <trawick@gmail.com> wrote:
> Index: CHANGES
> ===================================================================
> --- CHANGES (revision 1610531)
> +++ CHANGES (working copy)
> @@ -16,8 +16,10 @@
>    *) SECURITY: CVE-2014-0231 (cve.mitre.org)
>       mod_cgid: Fix a denial of service against CGI scripts that do
>       not consume stdin that could lead to lingering HTTPD child processes
> -     filling up the scoreboard and eventually hanging the server. Adds
> -     "CGIDScriptTimeout" directive.
> +     filling up the scoreboard and eventually hanging the server.  By
> +     default, the client I/O timeout (Timeout directive) now applies to
> +     communication with scripts.  The CGIDScriptTimeout directive can be
> +     used to set a different timeout for communication with scripts.
>       [Rainer Jung, Eric Covener, Yann Ylavic]
>
>    *) mod_ssl: Extend the scope of SSLSessionCacheTimeout to sessions
>
>
> Make sense?

+1