Bugzilla – Bug 918352
VUL-1: CVE-2015-0228: apache2: mod_lua websocket DoS
Last modified: 2016-04-27 20:18:16 UTC
CVE-2015-0228 mod_lua: A maliciously crafted websockets PING after a script calls r:wsupgrade() can cause a child process crash. Fixed in 643f0fcf3b8ab09a68f0ecd2aa37aafeda3e63ef. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0228 http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-0228.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0228
bugbot adjusting priority
This is an autogenerated message for OBS integration: This bug (918352) was mentioned in https://build.opensuse.org/request/show/287371 13.2 / apache2
Created attachment 624214 [details] upstream patch The following table expresses which products are affected (just Apache 2.4.x) and the current state of submissions: +---------------+---------+----------+----------------+ | product | version | affected | #sr/#mr | +---------------+---------+----------+----------------+ | SLE 11 | 2.2.12 | no | - | | SLE 12 | 2.4.10 | yes | wait for SWAMP | | openSUSE 13.1 | 2.4.6 | no * | - | | openSUSE 13.2 | 2.4.10 | yes | #287371 | | Factory | 2.4.11 | yes | #287376 | +---------------+---------+----------+----------------+ * mod_lua Websocket support was added later than Apache 2.4.6 was released therefore there isn't any affected code yet.
This is an autogenerated message for OBS integration: This bug (918352) was mentioned in https://build.opensuse.org/request/show/287777 Factory / apache2
openSUSE-SU-2015:0418-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 918352 CVE References: CVE-2015-0228 Sources used: openSUSE 13.2 (src): apache2-2.4.10-16.1
There is nothing to do yet. I reassigned this bug to the security-team until the submission for SLE12 is needed.
Submitted to SLE12: https://build.suse.de/request/show/54654
SUSE-SU-2015:0974-1: An update that solves four vulnerabilities and has two fixes is now available. Category: security (moderate) Bug References: 792309,871310,899836,909715,918352,923090 CVE References: CVE-2013-5704,CVE-2014-3581,CVE-2014-8109,CVE-2015-0228 Sources used: SUSE Linux Enterprise Software Development Kit 12 (src): apache2-2.4.10-12.1 SUSE Linux Enterprise Server 12 (src): apache2-2.4.10-12.1
was released a while ago.