Bug 1202988 (CVE-2015-0228) - CVE-2015-0228 httpd: Possible mod_lua crash due to websocket bug
Summary: CVE-2015-0228 httpd: Possible mod_lua crash due to websocket bug
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-0228
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1232127 1249799 1249800
Blocks: 1202992 1243893
TreeView+ depends on / blocked
 
Reported: 2015-03-17 20:35 UTC by Fabio Olive Leite
Modified: 2026-06-10 08:50 UTC (History)
36 users (show)

Fixed In Version: httpd 2.4.16
Clone Of:
Environment:
Last Closed: 2015-08-24 19:32:30 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1666 0 normal SHIPPED_LIVE Moderate: httpd24-httpd security update 2015-08-24 19:56:41 UTC

Description Fabio Olive Leite 2015-03-17 20:35:07 UTC
The lua_websocket_read function in lua_request.c in the mod_lua module in
the Apache HTTP Server through 2.4.12 allows remote attackers to cause a
denial of service (child-process crash) by sending a crafted WebSocket Ping
frame after a Lua script has called the wsupgrade function.

Comment 2 Tomas Hoger 2015-03-17 21:21:58 UTC
The affected mod_lua module was introduced upstream in version 2.4:

http://httpd.apache.org/docs/2.4/new_features_2_4.html#newmods

Therefore, this issue did not affect httpd versions as shipped in Red Hat Enterprise Linux 6 and earlier, which include httpd 2.2 or earlier.

Comment 3 Tomas Hoger 2015-03-18 10:05:56 UTC
Upstream commits in trunk and 2.4.x branch:

https://svn.apache.org/viewvc?view=revision&revision=1657261
https://svn.apache.org/viewvc?view=revision&revision=1664118

This is apparently planned to be fixed in not yet released 2.4.13.

Comment 4 Huzaifa S. Sidhpurwala 2015-06-16 06:16:47 UTC
This issue does not affect the version of httpd package as shipped with Red Hat Enterprise Linux 7, because mod_lua in that package does not have WebSocket support.

Comment 5 Huzaifa S. Sidhpurwala 2015-06-16 06:17:54 UTC
Created httpd tracking bugs for this issue:

Affects: fedora-all [bug 1232127]

Comment 6 Huzaifa S. Sidhpurwala 2015-06-16 06:22:02 UTC
Statement:

This issue did not affect the version of httpd package as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Comment 7 Fedora Update System 2015-07-21 08:12:26 UTC
httpd-2.4.16-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Tomas Hoger 2015-07-27 12:45:23 UTC
(In reply to Tomas Hoger from comment #3)
> This is apparently planned to be fixed in not yet released 2.4.13.

This was fixed in 2.4.13, but that version, along with version 2.4.14 and 2.4.15 were never released.  The first released version with the fix is 2.4.16.

External References:

http://httpd.apache.org/security/vulnerabilities_24.html#2.4.16

Comment 10 Tomas Hoger 2015-07-27 14:03:22 UTC
(In reply to Huzaifa S. Sidhpurwala from comment #4)
> This issue does not affect the version of httpd package as shipped with Red
> Hat Enterprise Linux 7, because mod_lua in that package does not have
> WebSocket support.

Upstream security page linked in comment 8 clarifies that the vulnerable code was introduced in upstream version 2.4.7.  The httpd packages in Red Hat Enterprise Linux 7 are based on older upstream version 2.4.6.

Comment 11 Fedora Update System 2015-07-30 00:51:55 UTC
httpd-2.4.16-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 errata-xmlrpc 2015-08-24 15:57:02 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS

Via RHSA-2015:1666 https://rhn.redhat.com/errata/RHSA-2015-1666.html

Comment 14 Frederik Larsen 2026-06-10 08:50:38 UTC
 if youre into free sex cam shit there is literally a flashing feast of naked tittays rocking anytime u click. you scroll a couple stores across sex live category from bbw extrabw swallowing dragon dildo to skinny emo alt hottie edgeplay private room humping pillow sweat soaked after 2 hours pushin vibe on clit chat paiding out like crazy. couples section has cheating milf and her hubbys 'golf buddy' raw doggin on bed letting chat beat directions and tip spicy shit like jackhammer doggie pausing every thirty pump my idea bro. most babes will tease titties in public xxx chats quick to keep you hooked before draggin ur ass to pay token for proper naked session of complete nude live cam shows in private. seriously swing by and smash that fullscreen on fat ass massage chick oiling her cheeks camera level so u feel drip thru screen. 
https://sexcam.cafe/model/JulliaVegas/
https://livesex.work/model/EdytAlly/
https://livesexcams.fans/model/Vicky_Rico_/
betbow loves it when dudes whalesuhn tokens cuz she turns circular mirror so reflections double the whole live naked girls action making ur corner second cam sync like multi screen spankbank. wanna bust a nut without cash step in during token countdown those sexpots go spread eagle live cam strip and moan liquid nasty filth until zero left tip and you finish clean even with pocket empty.


Note You need to log in before you can comment on or make changes to this bug.