Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Fedora 40: Security Advisory FEDORA-2024-25f8e34407 for darkhttpd

fedora
Calendar Grey July 27, 2024
Dist Fedora Esm H88
Fedora 40 enhances darkhttpd 1.16 to fix local access problems and address authentication loophole vulnerabilities.
Update to 1.16 fixes rhbz#2259096

Summary

darkhttpd is a secure, lightweight, fast and single-threaded HTTP/1.1 server.

Features:

* Simple to set up:

* Single binary, no other files.

* Standalone, doesn't need inetd or ucspi-tcp.

* No messing around with config files.

* Written in C - efficient and portable.

* Small memory footprint.

* Event loop, single threaded - no fork() or pthreads.

* Generates directory listings.

* Supports HTTP GET and HEAD requests.

* Supports Range / partial content.

* Supports If-Modified-Since.

* Supports Keep-Alive connections.

* Can serve 301 redirects based on Host header.

* Uses sendfile().

Security:

* Can log accesses, including Referer and User-Agent.

* Can chroot.

* Can drop privileges.

* Impervious to /../ sniffing.

* Times out idle connections.

* Drops overly long requests.

Limitations:

* This server only serves static content - *NO* CGI supported!

Update Information:

Update to 1.16 fixes rhbz#2259096

Topics%20covered

Topics Covered

security advisory update Fedora authentication bypass local access issue darkhttpd remote credentials

Change Log

* Thu Jul 18 2024 Filipe Rosset - 1.16-1 - Update to 1.16 fixes rhbz#2259096 * Wed Jul 17 2024 Fedora Release Engineering - 1.14-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

References


[ 1 ] Bug #2259096 - darkhttpd-1.16 is available https://bugzilla.redhat.com/show_bug.cgi?id=2259096 [ 2 ] Bug #2259490 - CVE-2024-23770 darkhttpd: allows local users to discover credentials [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2259490 [ 3 ] Bug #2259491 - CVE-2024-23770 darkhttpd: allows local users to discover credentials [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2259491 [ 4 ] Bug #2259493 - CVE-2024-23771 darkhttpd: uses strcmp to verify authentication to bypass authentication via a timing side channel [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2259493 [ 5 ] Bug #2259494 - CVE-2024-23771 darkhttpd: uses strcmp to verify authentication to bypass authentication via a timing side channel [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2259494

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-25f8e34407' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
important
Lowest
Low
Medium
High
Critical

Name: darkhttpd
Product: Fedora 40
Version: 1.16
Release: 1.fc40
URL: https://github.com/emikulic/darkhttpd
Summary: Secure, lightweight, fast, single-threaded HTTP/1.1 server

Topics%20covered

Topics Covered

security advisory update Fedora authentication bypass local access issue darkhttpd remote credentials

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here