Clarify CL: the CVE security fix already in 4.80.1

[exim.git] / doc / doc-txt / ChangeLog

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 9d9f17d5b4b2df4b16ec0ea0929d4bfd7a8ce00e..66b9e99d52393ddd21e4cfa9d3a7839722f7a4f5 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -87,6 +87,7 @@ JH/10 Add 8bitmime log_selector, for 8bitmime status on the received line.
 
 PP/11 SECURITY: protect DKIM DNS decoding from remote exploit.
       CVE-2012-5671
+      (nb: this is the same fix as in Exim 4.80.1)
 
 JH/11 Add A= logging on delivery lines, and a client_set_id option on
       authenticators.
@@ -223,6 +224,12 @@ TL/09 Add expansion variable $authenticated_fail_id to keep track of
 TL/10 Bugzilla 1375 - Prevent TLS rebinding in ldap. Patch provided by
       Alexander Miroch.
 
+TL/11 Bugzilla 1382 - Option ldap_require_cert overrides start_tls
+      ldap library initialization, allowing self-signed CA's to be
+      used. Also properly sets require_cert option later in code by
+      using NULL (global ldap config) instead of ldap handle (per
+      session). Bug diagnosis and testing by alxgomz.
+
 
 Exim version 4.80.1
 -------------------