lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. Reference: https://redmine.lighttpd.net/issues/2945 Upstream commit: https://github.com/lighttpd/lighttpd1.4/commit/32120d5b8b3203fc21ccb9eafb0eaf824bb59354
Created lighttpd tracking bugs for this issue: Affects: fedora-all [bug 1699733]
Created lighttpd tracking bugs for this issue: Affects: epel-all [bug 1699734]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.