---------- Forwarded message ---------- From: Anssi Johansson Date: Saturday, August 24, 2013 Subject: EPEL Lighttpd vulnerability still unfixed after 9 months To: epel-de...@lists.fedoraproject.org
Hi, may I please direct some provenpackager's attention to https://bugzilla.redhat.com/show_bug.cgi?id=878915 -- lighttpd: Denial of Service via malformed Connection headers (CVE-2012-5533) The bug was filed in November 2012, or approximately nine months ago. EPEL still ships a vulnerable version 1.4.31 for both EL5 and EL6. I think it'd be high time to release a fixed version, especially as exploiting the vulnerability is rather trivial: echo -ne "GET / HTTP/1.1\r\nHost: victim.com\r\nConnection: TE,,Keep-Alive\r\n\r\n" | nc victim.com 80 Everything that's needed is included in the bug report (as far as I can tell). It'd only need someone to package the new version and push it through EPEL's buildsystem. _______________________________________________ epel-devel mailing list epel-de...@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/epel-devel -- *Yours sincerely,* *Christopher Meng* Always playing in Fedora Project http://cicku.me
-- devel mailing list devel@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/devel Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
