The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.
The affected mod_lua module was introduced upstream in version 2.4: http://httpd.apache.org/docs/2.4/new_features_2_4.html#newmods Therefore, this issue did not affect httpd versions as shipped in Red Hat Enterprise Linux 6 and earlier, which include httpd 2.2 or earlier.
Upstream commits in trunk and 2.4.x branch: https://svn.apache.org/viewvc?view=revision&revision=1657261 https://svn.apache.org/viewvc?view=revision&revision=1664118 This is apparently planned to be fixed in not yet released 2.4.13.
This issue does not affect the version of httpd package as shipped with Red Hat Enterprise Linux 7, because mod_lua in that package does not have WebSocket support.
Created httpd tracking bugs for this issue: Affects: fedora-all [bug 1232127]
Statement: This issue did not affect the version of httpd package as shipped with Red Hat Enterprise Linux 5, 6 and 7.
httpd-2.4.16-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
(In reply to Tomas Hoger from comment #3) > This is apparently planned to be fixed in not yet released 2.4.13. This was fixed in 2.4.13, but that version, along with version 2.4.14 and 2.4.15 were never released. The first released version with the fix is 2.4.16. External References: http://httpd.apache.org/security/vulnerabilities_24.html#2.4.16
(In reply to Huzaifa S. Sidhpurwala from comment #4) > This issue does not affect the version of httpd package as shipped with Red > Hat Enterprise Linux 7, because mod_lua in that package does not have > WebSocket support. Upstream security page linked in comment 8 clarifies that the vulnerable code was introduced in upstream version 2.4.7. The httpd packages in Red Hat Enterprise Linux 7 are based on older upstream version 2.4.6.
httpd-2.4.16-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS Via RHSA-2015:1666 https://rhn.redhat.com/errata/RHSA-2015-1666.html
if youre into free sex cam shit there is literally a flashing feast of naked tittays rocking anytime u click. you scroll a couple stores across sex live category from bbw extrabw swallowing dragon dildo to skinny emo alt hottie edgeplay private room humping pillow sweat soaked after 2 hours pushin vibe on clit chat paiding out like crazy. couples section has cheating milf and her hubbys 'golf buddy' raw doggin on bed letting chat beat directions and tip spicy shit like jackhammer doggie pausing every thirty pump my idea bro. most babes will tease titties in public xxx chats quick to keep you hooked before draggin ur ass to pay token for proper naked session of complete nude live cam shows in private. seriously swing by and smash that fullscreen on fat ass massage chick oiling her cheeks camera level so u feel drip thru screen. https://sexcam.cafe/model/JulliaVegas/ https://livesex.work/model/EdytAlly/ https://livesexcams.fans/model/Vicky_Rico_/ betbow loves it when dudes whalesuhn tokens cuz she turns circular mirror so reflections double the whole live naked girls action making ur corner second cam sync like multi screen spankbank. wanna bust a nut without cash step in during token countdown those sexpots go spread eagle live cam strip and moan liquid nasty filth until zero left tip and you finish clean even with pocket empty.