Subject: [ANNOUNCE] mod_ssl 2.8.12

From: "Ralf S. Engelschall" <[email-masked]>
Date: Wed, 23 Oct 2002 11:15:19 +0200

Because of a found Cross-Side-Scripting (XSS) bug in mod_ssl, the fixed
maintainance version mod_ssl 2.8.12 is available for use with Apache
1.3.27.

http://www.modssl.org/source/
 ftp://ftp.modssl.org/source/
                                       Ralf S. Engelschall
                                       [email-masked]
                                       www.engelschall.com

  Changes with mod_ssl 2.8.12 (04-Oct-2002 to 23-Oct-2002)

   *) Fixed potential Cross-Site-Scripting bug.

   *) Allow also 8192 bytes of shared memory data size.
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Martin Kraemer <[email-masked]>
Date: Wed, 23 Oct 2002 16:51:53 +0200

> maintainance version mod_ssl 2.8.12 is available for use with Apache

Thanks!

...but the snakeoil certificates are still expired:

% openssl x509 -noout -text < mod_ssl-2.8.12-1.3.27/pkg.sslcfg/snakeoil-ca-rsa.crt
...
        Validity
            Not Before: Oct 21 18:21:46 1999 GMT
            Not After : Oct 20 18:21:46 2001 GMT

% openssl x509 -noout -text < mod_ssl-2.8.12-1.3.27/pkg.sslcfg/snakeoil-rsa.crt
...
        Validity
            Not Before: Oct 21 18:21:51 1999 GMT
            Not After : Oct 20 18:21:51 2001 GMT

    Martin
-- 
<[email-masked]>         |     Fujitsu Siemens
Fon: +49-89-636-46021, FAX: +49-89-636-47655 | 81730  Munich,  Germany
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]