merge security fix from 4.3.x