Which version fixed the CVE-2020-9490, CVE-2020-11984 and CVE-2020-11993 vulnerabilities?

[Pavel Lyalyakin]

Hello,

The version 2.4 vulnerabilities page[1] tells that CVE-2020-9490, CVE-2020-11984 and CVE-2020-11993 were fixed in 2.4.44. But the version 2.4.46 changelog[2] tells that these vulnerabilities were fixed in version 2.4.46.

So were they fixed in 2.4.44 or in 2.4.46?

[1]: https://httpd.apache.org/security/vulnerabilities_24.html

[2]: https://downloads.apache.org/httpd/CHANGES_2.4.46

--

[Yehuda Katz]

2.4.44 and 2.4.45 were never released. Everything that was in 44 and 45 is in 46.

- Y

On Tue, Aug 11, 2020, 8:46 AM Pavel Lyalyakin wrote:

Hello,

The version 2.4 vulnerabilities page[1] tells that CVE-2020-9490, CVE-2020-11984 and CVE-2020-11993 were fixed in 2.4.44. But the version 2.4.46 changelog[2] tells that these vulnerabilities were fixed in version 2.4.46.

So were they fixed in 2.4.44 or in 2.4.46?

[1]: https://httpd.apache.org/security/vulnerabilities_24.html

[2]: https://downloads.apache.org/httpd/CHANGES_2.4.46

--

[Pavel Lyalyakin]

Understood. Thank you!

On Tue, Aug 11, 2020 at 5:03 PM Yehuda Katz <[hidden email]> wrote:

2.4.44 and 2.4.45 were never released. Everything that was in 44 and 45 is in 46.

- Y

Sent from a device with a very small keyboard and hyperactive autocorrect.

On Tue, Aug 11, 2020, 8:46 AM Pavel Lyalyakin wrote:

Hello,

The version 2.4 vulnerabilities page[1] tells that CVE-2020-9490, CVE-2020-11984 and CVE-2020-11993 were fixed in 2.4.44. But the version 2.4.46 changelog[2] tells that these vulnerabilities were fixed in version 2.4.46.

So were they fixed in 2.4.44 or in 2.4.46?

[1]: https://httpd.apache.org/security/vulnerabilities_24.html

[2]: https://downloads.apache.org/httpd/CHANGES_2.4.46

--

With best regards,
Pavel Lyalyakin
VisualSVN Team

--