clarify that "patch" on contrib plugins means the author wants to merge

[git.ikiwiki.info.git] / doc / security.mdwn

diff --git a/doc/security.mdwn b/doc/security.mdwn
index 5c54031a86ae403198a0591a67f20e74c73142df..e7770dd27c61b747ae82c6e4fb4e209acd4e5ffd 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -564,8 +564,8 @@ which are both used in most ikiwiki installations.
 This bug was reported on 2016-12-17. A partially fixed version
 3.20161219 was released on 2016-12-19, but the solution used in that
 version was not effective with git versions older than 2.8.0.
-A more complete fix was released on 2016-12-29 in version 3.20161229.
-A backport to Debian 8 'jessie' is in progress.
+A more complete fix was released on 2016-12-29 in version 3.20161229,
+with fixes backported to Debian 8 in version 3.20141016.4.
 
 ([[!debcve CVE-2016-10026]] represents the original vulnerability.
 [[!debcve CVE-2016-9645]]/OVE-20161226-0002 represents the vulnerability
@@ -598,7 +598,7 @@ in version 3.20141016.4.
 
 ## <span id="cve-2017-0356">Authentication bypass via repeated parameters</span>
 
-The ikiwiki maintainers discovered further flaws similar 2016-9646
+The ikiwiki maintainers discovered further flaws similar to CVE-2016-9646
 in the passwordauth plugin's use of CGI::FormBuilder, with a more
 serious impact: