Change log Questions

[fernbednartrung]

I have a couple change log questions for tomcat6-6.0.24-95.

Where can I get more info on each rhbz# ?

Was CVE-2011-0013 patched since version 6.0.24-28?

What does 'commented out until needed mean? Is that only for CVE-2010-3718?

* Wed Apr 13 2011 David Knox <dknox@redhat.com> 0:6.0.24-29
- Resolves: rhbz#656403, rhbz#675926, rhbz#676011
- CVE-2010-4172, CVE-2010-3718, CVE-2011-0013, CVE-2010-4476,
- CVE-2011-0534


* Tue Apr 12 2011 David Knox <dknox@redhat.com> 0:6.0.24-28
- Resovles rhbz#695284 - wrapper logs to different locations
- CVE-2010-4172, CVE-2011-0013, CVE-2010-3718 commented out
- until needed.

Any help and information would be greatly appreciated.

[TrevorH]

No-one other than the author of those comments will know. You might be able to gain a clue by reading the bugzilla.redhat.com entries that are listed there as well though it would not surprise me to find they're marked private. You can also try reading the RH CVE pages for them - refer to http://access.redhat.com/security/cve/ - for example https://access.redhat.com/security/cve/CVE-2014-0224