https://bz.apache.org/bugzilla/show_bug.cgi?id=70289
--- Comment #3 from Michael Kim <[email protected]> --- Thank you for confirming the issue and preparing PR #909, including the follow-up fix in `cache_select()`. Given the demonstrated cross-client disclosure, could the Apache httpd security team assess whether these related cache storage and replay defects warrant a security advisory and CVE assignment? I understand the impact depends on the specific configuration and an otherwise publicly cacheable, identity-varying response, and I defer to your assessment. If a CVE is assigned, please credit Michael Kim (@seslo82) for the original report and share the affected and fixed versions. Thank you for investigating this so quickly. -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
