Bug 435805 (CVE-2008-1111)

Summary:	CVE-2008-1111 lighttpd CGI source disclosure
Product:	[Other] Security Response	Reporter:	Red Hat Product Security <security-response-team>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	matthias
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1111
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-07-21 09:45:28 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	435807, 435808, 435809
Bug Blocks:

Description Lubomir Kundrak 2008-03-03 23:07:35 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-1111 to the following vulnerability:

When mod_cgi running onlighttpd is unable to fork anymore (for instance if
ulimit is reached) lighty sends the full source of the cgi script. This is
rather serious and affects all users of mod_cgi. The patch (found at lighttpd's
subversion repository) returns a 500 response instead.

References:

http://trac.lighttpd.net/trac/changeset/2107
http://bugs.gentoo.org/show_bug.cgi?id=211956

Comment 2 Fedora Update System 2008-03-04 10:58:16 UTC

lighttpd-1.4.18-6.fc8 has been submitted as an update for Fedora 8

Comment 3 Fedora Update System 2008-03-04 11:34:55 UTC

lighttpd-1.4.18-3.fc7 has been submitted as an update for Fedora 7

Comment 4 Fedora Update System 2008-03-06 16:34:52 UTC

lighttpd-1.4.18-3.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2008-03-06 16:36:12 UTC

lighttpd-1.4.18-6.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Red Hat Product Security 2008-07-21 09:45:28 UTC

This issue was addressed in:

Fedora:
  https://admin.fedoraproject.org/updates/F8/FEDORA-2008-2278

Comment 8 Red Hat Bugzilla 2009-10-23 19:06:45 UTC

Reporter changed to security-response-team by request of Jay Turner.