CHANGES · deaeb1407a553fcfe9a0c8158cad8a780c52139d · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd · GitLab

*) SECURITY: [CAN-2002-0840] HTML-escape the address produced by · deaeb140

William A. Rowe Jr authored Oct 02, 2002

     ap_server_signature() against this cross-site scripting
     vulnerability exposed by the directive 'UseCanonicalName Off'.
     Also HTML-escape the SERVER_NAME environment variable for CGI
     and SSI requests.  It's safe to escape as only the '<', '>',
     and '&' characters are affected, which won't appear in a valid
     hostname.  Reported by Matthew Murphy <mattmurphy@kc.rr.com>.
     [Brian Pane]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@97064 13f79535-47bb-0310-9956-ffa450edef68

deaeb140

To find the state of this project's repository at the time of any of these versions, check out the tags.