NEWS

remicollet · remicollet · commit d339e614f1e4 · 2024-04-10T14:28:16.000+02:00
(cherry picked from commit 24f7790) (cherry picked from commit 027bdbc) (cherry picked from commit fbeed18) (cherry picked from commit be83060) (cherry picked from commit 9ec5a1e)
diff --git a/NEWS b/NEWS
@@ -6,6 +6,8 @@ Backported from 8.1.28
 - Standard:
   . Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to
     partial CVE-2022-31629 fix). (CVE-2024-2756) (nielsdos)
+  . Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true,
+    opening ATO risk). (CVE-2024-3096) (Jakub Zelenka)
 
 Backported from 8.0.30
 
