Changeset 17b2836 in mod_gnutls

Timestamp:

Feb 23, 2023, 2:18:04 PM (4 weeks ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

main, master

Parents:

82cb66b

git-author:

Fiona Klute <fiona.klute@…> (02/23/23 14:17:19)

git-committer:

Fiona Klute <fiona.klute@…> (02/23/23 14:18:04)

Message:

Note CVE ID in changelog for 0.12.1

The CVE ID was assigned a little after publishing the release, add it
for clarity.

File:

• CHANGELOG (modified) (1 diff)

CHANGELOG

@@ -1 +1 @@
 ** Version 0.12.1 (2023-02-23)
 
-- Security fix: Remove an infinite loop in blocking read on transport
-  timeout. Mod_gnutls versions from 0.9.0 to 0.12.0 (including) did
-  not properly fail blocking read operations on TLS connections when
-  the transport hit timeouts. Instead it entered an endless loop
-  retrying the read operation, consuming CPU resources. This could be
-  exploited for denial of service attacks. If trace level logging was
-  enabled, it would also produce an excessive amount of log output
-  during the loop, consuming disk space.
+- Security fix (CVE-2023-25824): Remove an infinite loop in blocking
+  read on transport timeout. Mod_gnutls versions from 0.9.0 to 0.12.0
+  (including) did not properly fail blocking read operations on TLS
+  connections when the transport hit timeouts. Instead it entered an
+  endless loop retrying the read operation, consuming CPU
+  resources. This could be exploited for denial of service attacks. If
+  trace level logging was enabled, it would also produce an excessive
+  amount of log output during the loop, consuming disk space.
 
 - Replace obsolete Autoconf macros. Generating ./configure now