LWN.net Logo

libapreq2: algorithm weakness

Package(s):libapreq2-perl apache2 CVE #(s):CVE-2006-0042
Created:March 14, 2006 Updated:April 18, 2006
Description: An algorithm weakness has been discovered in Apache2::Request, the generic request library for Apache2 which can be exploited remotely and cause a denial of service via CPU consumption.
Alerts:
Gentoo 200604-08 2006-04-17
Debian DSA-1000-2 2006-04-03
Debian DSA-1000-1 2006-03-14

(Log in to post comments)

apache2: algorithm weakness

Posted Mar 16, 2006 20:14 UTC (Thu) by mattdm (guest, #18) [Link]

I think the headline here should be changed to "libapreq" or "Apache HTTP Request Library" -- "apache2" gives the mistaken first impression that this is an Apache HTTP Server (httpd) flaw.

apache2: algorithm weakness

Posted Mar 20, 2006 22:44 UTC (Mon) by roelofs (guest, #2599) [Link]

Unfortunately, LWN tends to use the package name of the first(?) distro-advisory about a given piece of software. This leads to multiple items/articles for the same software (sometimes with very different titles), "hidden" and misidentified software advisories (e.g., zip-within-tar-advisory or gzip-should-have-been-bzip2-advisory), etc.

Of course, there are a lot of software packages out there, and a lot of advisories for them, so it must be fairly tedious even to collect the individual distros' advisories into the concise LWN summaries that currently exist. Nevertheless, there's room for improvement, if and when there are resources available to do so...

Greg

Room for improvement

Posted Mar 20, 2006 22:55 UTC (Mon) by corbet (editor, #1) [Link]

There's a lot of room for improvement, and we know it. Keeping up with security could easily be a full-time job for somebody. Someday we'll be able to staff it at that level...

Room for improvement

Posted Mar 20, 2006 23:42 UTC (Mon) by mattdm (guest, #18) [Link]

Yep -- not posting to complain, but to help. :)

Room for improvement

Posted Mar 21, 2006 3:13 UTC (Tue) by roelofs (guest, #2599) [Link]

Yep -- not posting to complain, but to help. :)

Likewise! (Oops, sorry--I guess this is a "me too" posting...)

Greg

Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds