Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 3 Mar 2008 01:10:24 +0100
From: Robert Buchholz <rbu@...too.org>
To: oss-security@...ts.openwall.com,
 coley@...re.org
Subject: CVE request: lighttpd mod_cgi script source disclosure

Hey all,

mod_cgi in lighttpd 1.4.18 (and earlier?) will send the source of a cgi 
script if it fails to fork the cgi handler, instead of an HTTP 500. 
mod_cgi is disabled by default.

See for a patch:
  http://trac.lighttpd.net/trac/changeset/2107
  https://bugs.gentoo.org/show_bug.cgi?id=211956

Please assign a CVE id.


Thanks, Robert

Download attachment "signature.asc " of type "application/pgp-signature" (190 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.