# changelog

author: <jdennis@redhat.com> - 2.3.7-3
changelog:
  - Resolves: rhbz# 1614977 - fix unit test segfault,
    the problem was not limited exclusively to s390x, but s390x provoked it.


author: Jakub Hrozek <jhrozek@redhat.com> - 2.3.7-4.1
changelog:
  - Resolves: rhbz#1820666 - CVE-2019-14857 mod_auth_openidc:2.3/mod_auth_openidc:
                             Open redirect in logout url when using URLs with
                             leading slashes [rhel-8.2.0.z]
  - Resolves: rhbz#1820662 - CVE-2019-20479 mod_auth_openidc:2.3/mod_auth_openidc:
                             open redirect issue exists in URLs with slash and
                             backslash [rhel-8.2.0.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.3.7-4.2
changelog:
  - Fix the previous backport
  - Related: rhbz#1820666 - CVE-2019-14857 mod_auth_openidc:2.3/mod_auth_openidc:
                            Open redirect in logout url when using URLs with
                            leading slashes [rhel-8.2.0.z]
  - Related: rhbz#1820662 - CVE-2019-20479 mod_auth_openidc:2.3/mod_auth_openidc:
                            open redirect issue exists in URLs with slash and
                            backslash [rhel-8.2.0.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.3.7-4.3
changelog:
  - Actually apply the previous patch, sigh
  - Related: rhbz#1820666 - CVE-2019-14857 mod_auth_openidc:2.3/mod_auth_openidc:
                            Open redirect in logout url when using URLs with
                            leading slashes [rhel-8.2.0.z]
  - Related: rhbz#1820662 - CVE-2019-20479 mod_auth_openidc:2.3/mod_auth_openidc:
                            open redirect issue exists in URLs with slash and
                            backslash [rhel-8.2.0.z]


