lighttpd: security bump to version 1.14.51

PATCH New Peter Korsgaard 4 participants 8 messages Oct 30, 2018 – Nov 13, 2018

lore

Share & tools

lore

Peter Korsgaard

author

2018-10-30 10:21 UTC #0 lore raw

PATCH 1/2 lighttpd: security bump to version 1.14.51

Fixes the following security issues:

1.4.50:
[mod_alias] security: potential path traversal with specific configs [core] security: use-after-free invalid Range req
[mod_alias] security: path traversal in mod_alias (in some use cases) (fixes #2898) [core] security: use-after-free after invalid Range request (fixes #2899)

1.4.51:
[core,security] process headers after combining folded headers [mod_userdir] security: skip username ?.? and ?..?

1.4.51 brings optional pam and wolfssl support. Explicitly disable these options for now.

Signed-off-by Peter Korsgaard <[email protected]>

---
 package/lighttpd/lighttpd.hash | 4 ++--
 package/lighttpd/lighttpd.mk   | 4 +++-
 2 files changed, 5 insertions(+), 3 deletions(-)

package/lighttpd/lighttpd.hash +2 -2

index c99e240c7b..0829c6b4c9 100644
@@ -1,4 +1,4 @@
-# From https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.49.sha256sum
-sha256 aedf49d7127d9e4c0ea56618e9e945a17674dc46a37ac7990120f87dd939ce09  lighttpd-1.4.49.tar.xz
+# From https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.51.sha256sum
+sha256 2af9fdb265d1f025bfa634e13770239712ecbd585e4975b8226edf1df74e9c82  lighttpd-1.4.51.tar.xz
 # Locally calculated
 sha256 5c98cad2fbaf5c5e2562bcbab401a7c557c1bb1bac9914ecc63730925052fb13  COPYING

package/lighttpd/lighttpd.mk +3 -1

index 06561e9f55..44bee6f90f 100644
@@ -5,13 +5,15 @@
 ################################################################################
 
 LIGHTTPD_VERSION_MAJOR = 1.4
-LIGHTTPD_VERSION = $(LIGHTTPD_VERSION_MAJOR).49
+LIGHTTPD_VERSION = $(LIGHTTPD_VERSION_MAJOR).51
 LIGHTTPD_SOURCE = lighttpd-$(LIGHTTPD_VERSION).tar.xz
 LIGHTTPD_SITE = http://download.lighttpd.net/lighttpd/releases-$(LIGHTTPD_VERSION_MAJOR).x
 LIGHTTPD_LICENSE = BSD-3-Clause
 LIGHTTPD_LICENSE_FILES = COPYING
 LIGHTTPD_DEPENDENCIES = host-pkgconf
 LIGHTTPD_CONF_OPTS = \
+	--without-pam \
+	--without-wolfssl \
 	--libdir=/usr/lib/lighttpd \
 	--libexecdir=/usr/lib

Signature · 1 line

2.11.0

Peter Korsgaard

author

2018-10-30 20:04 UTC #1 lore raw

PATCH 1/2 lighttpd: security bump to version 1.14.51

Quoted 9 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
Fixes the following security issues:
1.4.50:
[mod_alias] security: potential path traversal with specific configs [core] security: use-after-free invalid Range req
[mod_alias] security: path traversal in mod_alias (in some use cases) (fixes #2898) [core] security: use-after-free after invalid Range request (fixes #2899)

Quoted 8 lines

1.4.51:
[core,security] process headers after combining folded headers [mod_userdir] security: skip username ?.? and ?..?
1.4.51 brings optional pam and wolfssl support. Explicitly disable these options for now.
Signed-off-by Peter Korsgaard <[email protected]>

Committed, thanks.

Signature · 1 line

Bye, Peter Korsgaard

Peter Korsgaard

author

2018-11-13 23:11 UTC #2 lore raw

PATCH 1/2 lighttpd: security bump to version 1.14.51

In reply to Peter Korsgaard

Quoted 9 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
Fixes the following security issues:
1.4.50:
[mod_alias] security: potential path traversal with specific configs [core] security: use-after-free invalid Range req
[mod_alias] security: path traversal in mod_alias (in some use cases) (fixes #2898) [core] security: use-after-free after invalid Range request (fixes #2899)

Quoted 8 lines

1.4.51:
[core,security] process headers after combining folded headers [mod_userdir] security: skip username ?.? and ?..?
1.4.51 brings optional pam and wolfssl support. Explicitly disable these options for now.
Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2018.02.x and 2018.08.x, thanks.

Signature · 1 line

Bye, Peter Korsgaard

Peter Korsgaard

author

2018-10-30 10:21 UTC #3 lore raw

PATCH 2/2 lighttpd: add optional pam support

In reply to Peter Korsgaard

Let the option depend on linux-pam as pam has quite some dependencies and this is unlikely to be used if pam isn't explicitly enabled.

Signed-off-by Peter Korsgaard <[email protected]>

---
 package/lighttpd/Config.in   | 7 +++++++
 package/lighttpd/lighttpd.mk | 8 +++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

package/lighttpd/Config.in +7 -0

index 383c10f70f..0f37422aea 100644
@@ -26,6 +26,13 @@ config BR2_PACKAGE_LIGHTTPD_OPENSSL
 	help
 	  Enable OpenSSL support for lighttpd.
 
+config BR2_PACKAGE_LIGHTTPD_PAM
+       bool "pam authentication support"
+       depends on BR2_PACKAGE_LINUX_PAM
+       default y
+       help
+         Enable PAM authentication support for lighttpd.
+
 config BR2_PACKAGE_LIGHTTPD_ZLIB
 	bool "zlib support"
 	select BR2_PACKAGE_ZLIB

package/lighttpd/lighttpd.mk +7 -1

index 44bee6f90f..d8f64dc7e8 100644
@@ -12,7 +12,6 @@ LIGHTTPD_LICENSE = BSD-3-Clause
 LIGHTTPD_LICENSE_FILES = COPYING
 LIGHTTPD_DEPENDENCIES = host-pkgconf
 LIGHTTPD_CONF_OPTS = \
-	--without-pam \
 	--without-wolfssl \
 	--libdir=/usr/lib/lighttpd \
 	--libexecdir=/usr/lib

@@ -24,6 +23,13 @@ else
 LIGHTTPD_CONF_OPTS += --without-openssl
 endif
 
+ifeq ($(BR2_PACKAGE_LIGHTTPD_PAM),y)
+LIGHTTPD_DEPENDENCIES += linux-pam
+LIGHTTPD_CONF_OPTS += --with-pam
+else
+LIGHTTPD_CONF_OPTS += --without-pam
+endif
+
 ifeq ($(BR2_PACKAGE_LIGHTTPD_ZLIB),y)
 LIGHTTPD_DEPENDENCIES += zlib
 LIGHTTPD_CONF_OPTS += --with-zlib

Signature · 1 line

2.11.0

Baruch Siach

2018-10-30 11:38 UTC #4 lore raw

PATCH 2/2 lighttpd: add optional pam support

Hi Peter,

Quoted 14 lines · Peter Korsgaard

Let the option depend on linux-pam as pam has quite some dependencies and this is unlikely to be used if pam isn't explicitly enabled.
Signed-off-by Peter Korsgaard <[email protected]>
---
 package/lighttpd/Config.in   | 7 +++++++
 package/lighttpd/lighttpd.mk | 8 +++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)
package/lighttpd/Config.in +0 -0
index 383c10f70f..0f37422aea 100644

package/lighttpd/Config.in config BR2_PACKAGE_LIGHTTPD_OPENSSL · line 35

Quoted 10 lines

package/lighttpd/Config.in +7 -0

@@ -26,6 +26,13 @@ config BR2_PACKAGE_LIGHTTPD_OPENSSL
 	help
 	  Enable OpenSSL support for lighttpd.
 
+config BR2_PACKAGE_LIGHTTPD_PAM
+       bool "pam authentication support"
+       depends on BR2_PACKAGE_LINUX_PAM
+       default y
+       help
+         Enable PAM authentication support for lighttpd.
+

Why do we need a config option? What is the size impact of the lighttpd PAM support?

baruch

Quoted 29 lines

package/lighttpd/Config.in +0 -0

 config BR2_PACKAGE_LIGHTTPD_ZLIB
 	bool "zlib support"
 	select BR2_PACKAGE_ZLIB

package/lighttpd/lighttpd.mk +7 -1

index 44bee6f90f..d8f64dc7e8 100644
@@ -12,7 +12,6 @@ LIGHTTPD_LICENSE = BSD-3-Clause
 LIGHTTPD_LICENSE_FILES = COPYING
 LIGHTTPD_DEPENDENCIES = host-pkgconf
 LIGHTTPD_CONF_OPTS = \
-	--without-pam \
 	--without-wolfssl \
 	--libdir=/usr/lib/lighttpd \
 	--libexecdir=/usr/lib

@@ -24,6 +23,13 @@ else
 LIGHTTPD_CONF_OPTS += --without-openssl
 endif
 
+ifeq ($(BR2_PACKAGE_LIGHTTPD_PAM),y)
+LIGHTTPD_DEPENDENCIES += linux-pam
+LIGHTTPD_CONF_OPTS += --with-pam
+else
+LIGHTTPD_CONF_OPTS += --without-pam
+endif
+
 ifeq ($(BR2_PACKAGE_LIGHTTPD_ZLIB),y)
 LIGHTTPD_DEPENDENCIES += zlib
 LIGHTTPD_CONF_OPTS += --with-zlib

Signature · 3 lines

     http://baruch.siach.name/blog/                  ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch at tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -

Peter Korsgaard

author

2018-10-30 13:49 UTC #5 lore raw

PATCH 2/2 lighttpd: add optional pam support

Quoted 21 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Baruch" == Baruch Siach <[email protected]> writes:
Hi Peter,
Quoted 17 lines · Peter Korsgaard
Let the option depend on linux-pam as pam has quite some dependencies and this is unlikely to be used if pam isn't explicitly enabled.
Signed-off-by Peter Korsgaard <[email protected]>
---
package/lighttpd/Config.in | 7 +++++++
package/lighttpd/lighttpd.mk | 8 +++++++-
2 files changed, 14 insertions(+), 1 deletion(-)
package/lighttpd/Config.in +0 -0
index 383c10f70f..0f37422aea 100644
@@ -26,6 +26,13 @@ config BR2_PACKAGE_LIGHTTPD_OPENSSL
help
Enable OpenSSL support for lighttpd.

Quoted 10 lines

package/lighttpd/Config.in config BR2_PACKAGE_LIGHTTPD_OPENSSL · line 35
Quoted 7 lines
package/lighttpd/Config.in +7 -0
+config BR2_PACKAGE_LIGHTTPD_PAM
+       bool "pam authentication support"
+       depends on BR2_PACKAGE_LINUX_PAM
+       default y
+       help
+         Enable PAM authentication support for lighttpd.
+
Why do we need a config option? What is the size impact of the lighttpd PAM support?

Just for consistency with the other BR2_PACKAGE_LIGHTTPD_* options. I would also prefer to use automatic dependencies like we do elsewhere, but as we are explicitly handling the other optional dependencies it seemed more sensible to do it for pam as well.

Signature · 1 line

Bye, Peter Korsgaard

Matthew Weber

2018-10-30 12:43 UTC #6 lore raw

PATCH 2/2 lighttpd: add optional pam support

In reply to Peter Korsgaard

Peter,

Quoted 41 lines · Peter Korsgaard

Let the option depend on linux-pam as pam has quite some dependencies and this is unlikely to be used if pam isn't explicitly enabled.

Signed-off-by Peter Korsgaard <[email protected]>

---
 package/lighttpd/Config.in   | 7 +++++++
 package/lighttpd/lighttpd.mk | 8 +++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

package/lighttpd/Config.in +7 -0

index 383c10f70f..0f37422aea 100644
@@ -26,6 +26,13 @@ config BR2_PACKAGE_LIGHTTPD_OPENSSL
        help
          Enable OpenSSL support for lighttpd.
 
+config BR2_PACKAGE_LIGHTTPD_PAM
+       bool "pam authentication support"
+       depends on BR2_PACKAGE_LINUX_PAM
+       default y
+       help
+         Enable PAM authentication support for lighttpd.
+
 config BR2_PACKAGE_LIGHTTPD_ZLIB
        bool "zlib support"
        select BR2_PACKAGE_ZLIB

package/lighttpd/lighttpd.mk +0 -1

index 44bee6f90f..d8f64dc7e8 100644
@@ -12,7 +12,6 @@ LIGHTTPD_LICENSE = BSD-3-Clause
 LIGHTTPD_LICENSE_FILES = COPYING
 LIGHTTPD_DEPENDENCIES = host-pkgconf
 LIGHTTPD_CONF_OPTS = \
-       --without-pam \
        --without-wolfssl \
        --libdir=/usr/lib/lighttpd \
        --libexecdir=/usr/lib

package/lighttpd/lighttpd.mk else · line 31

Quoted 9 lines

package/lighttpd/lighttpd.mk +6 -0

@@ -24,6 +23,13 @@ else
 LIGHTTPD_CONF_OPTS += --without-openssl
 endif
 
+ifeq ($(BR2_PACKAGE_LIGHTTPD_PAM),y)
+LIGHTTPD_DEPENDENCIES += linux-pam
+LIGHTTPD_CONF_OPTS += --with-pam
+else
+LIGHTTPD_CONF_OPTS += --without-pam
+endif

On the same note as Baruch, I dug through the code a bit and it looks like enabling it just adds the mod_auth_pam support. However a configuration file still needs to call out using that support. So it looks like from a compatibility to old target builds perspective, this can be enabled if PAM is present without any impact.

Matt

Thomas Petazzoni

Applied

2018-10-31 09:24 UTC #7 lore raw

PATCH 2/2 lighttpd: add optional pam support

In reply to Peter Korsgaard

Hello,

Quoted 8 lines · Peter Korsgaard

Let the option depend on linux-pam as pam has quite some dependencies and this is unlikely to be used if pam isn't explicitly enabled.
Signed-off-by Peter Korsgaard <[email protected]>
---
 package/lighttpd/Config.in   | 7 +++++++
 package/lighttpd/lighttpd.mk | 8 +++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

Applied to master, thanks.

Baruch: I indeed agree that automatic dependency handling could be used here, but Peter has a point that lighttpd doesn't do that today for other dependencies. So for consistency, it made sense to do the same for the linux-pam dependency as well.

Best regards,

Thomas

Signature · 3 lines

Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com