mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server
before 2.4.5 proceeds with save operations for a session without
considering the dirty flag and the requirement for a new session ID, which
has unspecified impact and remote attack vectors.