Fedora alert FEDORA-2010-7640 (boa)
| From: | updates@fedoraproject.org | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 12 Update: boa-0.94.14-0.15.rc21.fc12 | |
| Date: | Wed, 12 May 2010 17:55:34 +0000 | |
| Message-ID: | <20100512175534.AAFBE1109D2@bastion02.phx2.fedoraproject.org> | |
| Archive‑link: | Article |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2010-7640 2010-04-30 01:02:27 -------------------------------------------------------------------------------- Name : boa Product : Fedora 12 Version : 0.94.14 Release : 0.15.rc21.fc12 URL : http://www.boa.org/ Summary : Single-tasking HTTP server Description : Boa is a single-tasking HTTP server. That means that unlike traditional web servers, it does not fork for each incoming connection, nor does it fork many copies of itself to handle multiple connections. It internally multiplexes all of the ongoing HTTP connections, and forks only for CGI programs (which must be separate processes), automatic directory generation, and automatic file gunzipping. The primary design goals of Boa are speed and security. Security, in the sense of "can't be subverted by a malicious user," not "fine grained access control and encrypted communications". Boa is not intended as a feature-packed server. Available rpmbuild rebuild options : --with : debug access poll --without : gunzip sendfile -------------------------------------------------------------------------------- Update Information: This update fixes CVE-2009-4496 where HTTP request logs were written without sanitizing non-printable characters. -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 28 2010 Matthias Saou <http://freshrpms.net/> 0.94.14-0.15.rc21 - Include escape-errorlog patch from Debian to fix CVE-2009-4496 (#583162). * Tue Nov 24 2009 Matthias Saou <http://freshrpms.net/> 0.94.14-0.14.rc21 - Fix last minute init script breakage from the lat changes (#527582). -------------------------------------------------------------------------------- References: [ 1 ] Bug #583162 - CVE-2009-4496 boa: sanitize nonprintable characters in error logs https://bugzilla.redhat.com/show_bug.cgi?id=583162 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update boa' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-...