Category Archives: Fedora

Fedora – Security Updates

Fedora

Fedora 21 Security Update: erlang-17.4-1.fc21

Leave a comment

Resolved Bugs
1169375 – Disable SSL 3.0 in erlang-ssl
1059331 – CVE-2014-1693 erlang-inets: command injection flaw in FTP module
1059335 – CVE-2014-1693 erlang: erlang-inets: command injection flaw in FTP module [epel-all]
1161922 – Too many dependencies from Erlang<br
* Ver. 17.4
* Disable SSLv3
* Backport useful os:getenv/2 from master. See this GitHub pull request for further details – https://github.com/erlang/otp/pull/535
* Fixed CVE-2014-1693 (backported fix from ver. 17.x.x, see patch no. 17)
* Trimmed dependency chain

Fedora

Fedora EPEL 6 Security Update: libhtp-0.5.16-1.el6

Leave a comment

Resolved Bugs
1173605 – libhtp: denial of service with specific packets
1173610 – libhtp: denial of service with specific packets [epel-6]<br
This is a major update. API/ABI breaks are to be expected.
Extensive testing will be more than welcome.
Below is the upstream changelog from version 0.5.3 to the latest 0.5.16. Unfortunately, upstream didn’t maintain a changelog before that.
More details can be obtained by [comparing the current version in EPEL6, 0.3.0, and the one in this update](https://github.com/OISF/libhtp/compare/0.3.0…0.5.16).
### 0.5.16 (11 December 2014)
* Per personality requestline leading whitespace handling [Victor Julien]
* Improve request line parsing with leading spaces [Victor Julien]
* Harden decompress code against memory stress [Victor Julien]
### 0.5.15 (1 August 2014)
* Fixed [#78] Make a case-insensitive comparision for the pattern “chunked” for “Transfer-Encoding” [Anoop Saldanha]
### 0.5.14 (22 July 2014)
* Fixed the tests sometimes not returning the correct status code. Increased the the compiler warnings for the tests.
* Fixed [#77] Fix compiler warnings in the tests
### 0.5.13 (16 July 2014)
* Fixed [#56] Investigate clean-up performance with a large number of transactions on a single connection
### 0.5.12 (25 June 2014)
* Fixed [#73] Fix double Content-Length issue [Wesley Shields]
### 0.5.11 (5 April 2014)
* Fixed [#72] On CONNECT requests inbound tx progress prematurely set to complete
* Fixed [#71] Fix missing files in distribution target [Pierre Chifflier]
### 0.5.10 (3 March 2014)
* Fixed [#63] Final response body data callback missing on compressed responses.
* Do not consume the byte that comes after an invalid UTF-8 character.
* Use case insensitive comparison for content-coding values. Warn if unknown response content encoding is encountered.
* Small fixes. [#66, #69] [Victor Julien]
### 0.5.9 (19 November 2013)
* Fixed an `HTP_HOST_AMBIGUOUS` false positive.
* Fixed the tests not compiling on OS X 10.9.
### 0.5.8 (21 October 2013)
* Fixed [#54] Compression and base64 tests failing on some architectures.
* Fixed [#55] Incorrect ambiguous host warning on some CONNECT requests.
### 0.5.7 (18 September 2013)
* Use `umask()` with `mkstemp()` to ensure that temporary files are created with correct permissions. This addresses the potential security problem, but creates another, because umask() is not thread safe. For this and other reasons (see #52), file extraction will be removed in a future release.
* Fix copying `hook_response_complete` instead of `hook_transaction_complete`.
* Fix several small memory leaks that occur when memory allocation fails.
### 0.5.6 (22 July 2013)
* Fix memory leaks in `htp_tx_t::request_auth_username` and `htp_tx_t::request_auth_password`.
* [#43] When processing the response line, treat stream closure as the end of line.
* Fix normalization when the URL begins with `./`.
* Do not fail a stream with an incorrectly formed digest username.
* Do not stop processing request headers on PUT requests.
### 0.5.5 (18 July 2013)
* Tagging for a Suricata beta release.
* [#46] Fix the segfault that occurs under certain conditions when an invalid hostname is supplied.
* [#44] Fix libiconv detection on OpenBSD. [Victor Julien]
### 0.5.4 (17 July 2013)
* Tagging for a Suricata beta release.
* Added `htp_get_version()`, which returns the complete library name (e.g., “LibHTP v0.5.4”).
* Hard field limit is now treated as specifying the maximum amount of memory LibHTP will use for buffering per stream. Fields (e.g., headers) longer than this limit will be accepted if they are contained within a single buffer submitted to LibHTP (i.e., if LibHTP does not have to do any buffering in order to process them). Soft limits are currently not creating any warnings. This area will be improved in a future release.
* Invalid headers no longer fail the entire stream. They are now treated as headers without a name.
* `htp_conn_remove_tx()` now returns `HTP_DECLINED` (was `HTTP_ERROR`) if the specified transaction cannot be found.
* `htp_list_array_replace()` now returns `HTP_DECLINED` (was `HTP_ERROR`) if the element at the specified position does not exist.
* New public functions:
* `htp_status_t htp_urldecode_inplace(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, bstr *input, uint64_t *flags);`
* `htp_status_t htp_urldecode_inplace_ex(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, bstr *input, uint64_t *flags, int *expected_status_code);`
* Improved test coverage (84.1% lines, 91.3% functions).
### 0.5.3 (14 June 2013)
* Fix stream error when valid Basic Authentication information is provided.
* Do not fail the entire stream if the Authorization header is invalid. Raise `HTP_AUTH_INVALID` instead.
* When a request does not contain the request URI, leave `htp_tx_t::request_uri` `NULL`.