Author: Zhitao Li
Author Date: 2018-06-20 20:24:08 UTC

Added doc for new pull latency metrics.

Review: https://reviews.apache.org/r/67677

Author: James Peach
Author Date: 2018-06-15 23:16:31 UTC

Added MESOS-9002 to the 1.6.1 CHANGELOG.

Author: Jie Yu
Author Date: 2018-06-08 05:32:53 UTC

Added MESOS-8980 to 1.4.2 CHANGELOG.

(cherry picked from commit b0fe79e402c14fe876a5bc543874fe1edd8c2b44)

Author: Jie Yu
Author Date: 2018-06-08 05:31:48 UTC

Added MESOS-8980 to 1.5.2 CHANGELOG.

(cherry picked from commit 0369444a6ff4a75e62d1da72a45a648672c897e9)

Author: Alexander Rojas
Author Date: 2018-05-29 14:07:51 UTC

Added constant time comparison of JWT signatures.

A vulnerability in our JWT implementation allows an unauthenticated
remote attacker to execute to execute timing attacks [1].

This patch removes the vulnerability by adding a constant time
comparison of hashes, where the whole message is visited during
the comparison instead of returning at the first failure.

[1] https://codahale.com/a-lesson-in-timing-attacks/

Review: https://reviews.apache.org/r/67357