how to patch 3.0a21 for the lastest security hole?

[Chere Zhou]

I am guessing that older version of 3.0 should have the flaw patched by 2.2.8 
too.  I can not upgrade to HEAD yet.  If my 3.0a21 has the flaw, can someone 
point me to what files I need to look for a merge?

Thanks,
Chere