X-Git-Url: http://www.privoxy.org/gitweb/?a=blobdiff_plain;f=doc%2Fsource%2Fchangelog.sgml;h=c2812ba33e521455fbc48250031045570a9609a9;hb=b0757974c0f7cff7ad9a08a0e42cffe9593ebf37;hp=e75d284f2dfa9579638aba7444de567946f291e9;hpb=3fb5b49e4b9b2e99b1a12205f54ab0e22e77eade;p=privoxy.git

diff --git a/doc/source/changelog.sgml b/doc/source/changelog.sgml
index e75d284f..c2812ba3 100644
--- a/doc/source/changelog.sgml
+++ b/doc/source/changelog.sgml
@@ -3,7 +3,7 @@
 
  Purpose     :  Entity included in other project documents.
 
- $Id: changelog.sgml,v 2.3 2013/03/02 14:40:18 fabiankeil Exp $
+ $Id: changelog.sgml,v 2.6 2013/03/07 14:26:47 fabiankeil Exp $
 
  Copyright (C) 2013 Privoxy Developers http://www.privoxy.org/
  See LICENSE.
@@ -22,9 +22,8 @@
 
 <para>
  <application>Privoxy 3.0.21</application> stable is a bug-fix release
- for Privoxy 3.0.20 beta. It also addresses a security issue that affects
- all previous Privoxy versions (on some platforms). The changes since
- 3.0.20 beta are:
+ for Privoxy 3.0.20 beta. It addresses two security issues that
+ affect all previous Privoxy versions. The changes since 3.0.20 beta are:
 </para>
 
 <!--
@@ -44,6 +43,15 @@
       the limit to be reached.
      </para>
     </listitem>
+    <listitem>
+     <para>
+      Proxy authentication headers are removed unless the new directive
+      enable-proxy-authentication-forwarding is used. Forwarding the
+      headers potentially allows malicious sites to trick the user
+      into providing them with login information.
+      Reported by Chris John Riley.
+     </para>
+    </listitem>
     <listitem>
      <para>
       Compiles on OS/2 again now that unistd.h is only included