Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Fedora 39: Darkhttpd 2024-d638b9a34c Critical Security Update

fedora
Calendar Grey July 27, 2024
Dist Fedora Esm H88
The latest release of darkhttpd version 1.16 tackles security vulnerabilities, improving both the robustness and performance of the server.
Update to 1.16 fixes rhbz#2259096

Summary

darkhttpd is a secure, lightweight, fast and single-threaded HTTP/1.1 server.

Features:

* Simple to set up:

* Single binary, no other files.

* Standalone, doesn't need inetd or ucspi-tcp.

* No messing around with config files.

* Written in C - efficient and portable.

* Small memory footprint.

* Event loop, single threaded - no fork() or pthreads.

* Generates directory listings.

* Supports HTTP GET and HEAD requests.

* Supports Range / partial content.

* Supports If-Modified-Since.

* Supports Keep-Alive connections.

* Can serve 301 redirects based on Host header.

* Uses sendfile().

Security:

* Can log accesses, including Referer and User-Agent.

* Can chroot.

* Can drop privileges.

* Impervious to /../ sniffing.

* Times out idle connections.

* Drops overly long requests.

Limitations:

* This server only serves static content - *NO* CGI supported!

Update Information:

Update to 1.16 fixes rhbz#2259096

Topics%20covered

Topics Covered

security advisory update Fedora bug fix HTTP server darkhttpd

Change Log

* Thu Jul 18 2024 Filipe Rosset - 1.16-1 - Update to 1.16 fixes rhbz#2259096 * Wed Jul 17 2024 Fedora Release Engineering - 1.14-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild * Wed Jan 24 2024 Fedora Release Engineering - 1.14-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild * Fri Jan 19 2024 Fedora Release Engineering - 1.14-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

References


[ 1 ] Bug #2259096 - darkhttpd-1.16 is available https://bugzilla.redhat.com/show_bug.cgi?id=2259096 [ 2 ] Bug #2259490 - CVE-2024-23770 darkhttpd: allows local users to discover credentials [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2259490 [ 3 ] Bug #2259491 - CVE-2024-23770 darkhttpd: allows local users to discover credentials [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2259491 [ 4 ] Bug #2259493 - CVE-2024-23771 darkhttpd: uses strcmp to verify authentication to bypass authentication via a timing side channel [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2259493 [ 5 ] Bug #2259494 - CVE-2024-23771 darkhttpd: uses strcmp to verify authentication to bypass authentication via a timing side channel [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2259494

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-d638b9a34c' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: darkhttpd
Product: Fedora 39
Version: 1.16
Release: 1.fc39
URL: https://github.com/emikulic/darkhttpd
Summary: Secure, lightweight, fast, single-threaded HTTP/1.1 server

Topics%20covered

Topics Covered

security advisory update Fedora bug fix HTTP server darkhttpd

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here