Li Ming reported a serious bug in lighttpd:
If you send the request data very slow (e.g. sleep 0.01 after each byte), lighttpd will easily use all available memory and die (especially for parallel requests), allowing a DoS within minutes.
See:
The bug is tracked as CVE-2010-0295.
As far as we know all versions are affected.
We did some important bug fixes (some of them new since 1.4.24, and some older bugs). Only 2 small new features: traceback for lua errors and the SSL_CLIENT_* vars export for ssl client cert validation.
Update: There is a small regression in mod_magnet, see #1307
We finally added TLS SNI, and many other small improvements. We also fixed pipelining (that should fix problem with lighty as debian mirror) and some mod_fastcgi bugs - this should result in improved handling of overloaded and crashed backends (you know which one :D).
Time for a new release: spawn-fcgi is now going its own ways in an independent project (hence the release slogan; see https://redmine.lighttpd.net/projects/spawn-fcgi), wsgi applications in / should work now (use the fastcgi/scgi option “fix-root-scriptname”) and many other fixes and improvements.
Please note that the “X-Sendfile-Range” header did not make it into 1.4.23, and we will try a more powerful approach for 1.4.24 (see #2008).
And here we are again… we had some bad regressions, so 1.4.22 was needed earlier than we expected and spawn-fcgi is still included in this release.
But spawn-fcgi 1.6.0 has been released, see https://redmine.lighttpd.net/projects/spawn-fcgi/news, so expect it to be removed soon.
As mentioned before, we planned to extract spawn-fcgi into its own project and remove it from lighttpd.
Now the first standalone release has been published, starting at version 1.6.0.
Read more about it in the announcement: Release: spawn-fcgi 1.6.0
Future release announcements regarding spawn-fcgi will be published at https://redmine.lighttpd.net/projects/spawn-fcgi/news so please keep that in mind when looking for updates.
Four and a half months after the release of 1.4.20 comes a new version in the stable branch of lighty: 1.4.21 is here.\ It is a bugfix release but also contains 3 small new features.\ We would like to thank everybody who reported bugs, especially the ones who provided patches.
We decided to remove spawn-fcgi after this release from the lighttpd source, there is now a separate project for it:\ https://redmine.lighttpd.net/projects/spawn-fcgi
New setting to disable returning of a 417 if “Expect: 100-continue” header is given:
Settings that require numbers can now be strings too which get converted. Useful in conjunction wth env vars (thx andrewb)
$HTTP["language"] conditional (thx to petar) which allows interesting new configs like:
\$HTTP\["language"\] =\~ "(de\|it\|hr)" {\
url.redirect = ( "\^/\$" =\> "http://www.site.net/%1/" )\
}
5ff4e7075652f6cc200fa278ea2b1f966b42570b0b19cfbcb4324780c61625b139f6ef8e49eeba63c931fa82120711adc7182731e76f83b9c56c83f0a734ad0bdd20351fc97472d2After two prereleases and a lot of bugfixing, we are proud to announce a new release of the 1.4 branch: 1.4.20 is finally out. We would like to thank everybody who tested the prereleases and/or reported bugs in our ticket system. Please pay special attention to the security announcements:
Long time no see.
It has been almost half a year since 1.4.18. 6months. Jan has been working on many interesting features for 1.5.1 Currently he ports it to glib2.
But back to 1.4.19. Yes again the release date was nailed down by a few security bugs. cough Nevertheless we got a ton of other nice bugfixes. All praise our new lighttpd hero Stefan Bühler. Big thank you from my side. (darix)
79e2d61dd9017c3c50c0fe98b2289cae5c1255ee\
md5sum: cede410e7adee3ea14206749190a8b5d)fd4450e7faae55ebe0905114722995b0c57397cc\
md5sum: d787374e4e4aaa09d5cfa9ab9d23ad40)Reggie pointed me to the FastCGI support for Mono. For our lighttpd they have a full featured page that should cover all possible configuration needs.
Feel free to try it out and comment on this article if it works as expected.