openSUSE Security Update: Security update for lighttpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10132-1 Rating: moderate References: #1203358 Cross-References: CVE-2022-37797 CVSS scores: CVE-2022-37797 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-37797 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lighttpd fixes the following issues: lighttpd was updated to 1.4.66: * a number of bug fixes * Fix HTTP/2 downloads >= 4GiB * Fix SIGUSR1 graceful restart with TLS * futher bug fixes * CVE-2022-37797: null pointer dereference in mod_wstunnel, possibly a remotely triggerable crash (boo#1203358) * In an upcoming release the TLS modules will default to using stronger, modern chiphers and will default to allow client preference in selecting ciphers. ���CipherString��� => ���EECDH+AESGCM:AES256+EECDH:CHACHA20:SHA256:!SHA384���, ���Options��� => ���-ServerPreference��� old defaults: ���CipherString��� => ���HIGH���, ���Options��� => ���ServerPreference��� * A number of TLS options are how deprecated and will be removed in a future release: ��� ssl.honor-cipher-order ��� ssl.dh-file ��� ssl.ec-curve ��� ssl.disable-client-renegotiation ��� ssl.use-sslv2 ��� ssl.use-sslv3 The replacement option is ssl.openssl.ssl-conf-cmd, but lighttpd defaults should be prefered * A number of modules are now deprecated and will be removed in a future release: mod_evasive, mod_secdownload, mod_uploadprogress, mod_usertrack can be replaced by mod_magnet and a few lines of lua. update to 1.4.65: * WebSockets over HTTP/2 * RFC 8441 Bootstrapping WebSockets with HTTP/2 * HTTP/2 PRIORITY_UPDATE * RFC 9218 Extensible Prioritization Scheme for HTTP * prefix/suffix conditions in lighttpd.conf * mod_webdav safe partial-PUT * webdav.opts += (���partial-put-copy-modify��� => ���enable���) * mod_accesslog option: accesslog.escaping = ���json��� * mod_deflate libdeflate build option * speed up request body uploads via HTTP/2 * Behavior Changes * change default server.max-keep-alive-requests = 1000 to adjust * to increasing HTTP/2 usage and to web2/web3 application usage * (prior default was 100) * mod_status HTML now includes HTTP/2 control stream id 0 in the output * which contains aggregate counts for the HTTP/2 connection * (These lines can be identified with URL ���*���, part of ���PRI *��� preface) * alternative: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_status * MIME type application/javascript is translated to text/javascript (RFC 9239) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10132=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10132=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): lighttpd-1.4.66-bp154.2.3.1 lighttpd-debuginfo-1.4.66-bp154.2.3.1 lighttpd-debugsource-1.4.66-bp154.2.3.1 lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1 lighttpd-mod_authn_gssapi-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1 lighttpd-mod_authn_ldap-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1 lighttpd-mod_authn_pam-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1 lighttpd-mod_authn_sasl-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_magnet-1.4.66-bp154.2.3.1 lighttpd-mod_magnet-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1 lighttpd-mod_maxminddb-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1 lighttpd-mod_rrdtool-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_dbi-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_ldap-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_mysql-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_pgsql-debuginfo-1.4.66-bp154.2.3.1 lighttpd-mod_webdav-1.4.66-bp154.2.3.1 lighttpd-mod_webdav-debuginfo-1.4.66-bp154.2.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): lighttpd-1.4.66-bp153.2.9.1 lighttpd-mod_authn_gssapi-1.4.66-bp153.2.9.1 lighttpd-mod_authn_ldap-1.4.66-bp153.2.9.1 lighttpd-mod_authn_pam-1.4.66-bp153.2.9.1 lighttpd-mod_authn_sasl-1.4.66-bp153.2.9.1 lighttpd-mod_magnet-1.4.66-bp153.2.9.1 lighttpd-mod_maxminddb-1.4.66-bp153.2.9.1 lighttpd-mod_rrdtool-1.4.66-bp153.2.9.1 lighttpd-mod_vhostdb_dbi-1.4.66-bp153.2.9.1 lighttpd-mod_vhostdb_ldap-1.4.66-bp153.2.9.1 lighttpd-mod_vhostdb_mysql-1.4.66-bp153.2.9.1 lighttpd-mod_vhostdb_pgsql-1.4.66-bp153.2.9.1 lighttpd-mod_webdav-1.4.66-bp153.2.9.1 References: https://www.suse.com/security/cve/CVE-2022-37797.html https://bugzilla.suse.com/1203358