Bug 236489 (CVE-2007-1870)

Summary:	CVE-2007-1869, CVE-2007-1870: lighttpd < 1.4.14 DoS vulnerabilities
Product:	[Fedora] Fedora	Reporter:	Ville Skyttä <ville.skytta>
Component:	lighttpd	Assignee:	Matthias Saou <matthias>
Status:	CLOSED NEXTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6	CC:	fedora-security-list
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-04-16 11:35:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ville Skyttä 2007-04-15 06:29:24 UTC

http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt
http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt

All distros currently at 1.4.13.

Comment 1 Matthias Saou 2007-04-16 11:24:07 UTC

Since 1.4.15 doesn't seem to break any configuration syntax (I've tested an
update on a few servers, some with complex setups), I've decided to update all
currently supported branches to 1.4.15, which contains these fixes.

Note that the CVE-2007-1869 bug was already fixed in the devel and EL-5
branches, but they hadn't yet been rebuilt.

Comment 2 Matthias Saou 2007-04-16 11:35:59 UTC

Branches FC-5, FC-6 and devel (to become F7) have been updated.
No EL packages yet, since lua is still missing from EPEL.