CVE-2015-0228
Published: 16 February 2015
The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.
Notes
Author | Note |
---|---|
mdeslaur | mod_lua is in 2.4.x only mod_lua isn't built in trusty |
Priority
Status
Package | Release | Status |
---|---|---|
apache2 Launchpad, Ubuntu, Debian |
upstream |
Needs triage
|
lucid |
Not vulnerable
(2.2.14-5ubuntu8.14)
|
|
precise |
Not vulnerable
(2.2.22-1ubuntu1.7)
|
|
trusty |
Not vulnerable
(code not built)
|
|
utopic |
Released
(2.4.10-1ubuntu1.1)
|
|
Patches: upstream: https://github.com/apache/httpd/commit/643f0fcf3b8ab09a68f0ecd2aa37aafeda3e63ef upstream: https://github.com/apache/httpd/commit/1f1375a2a615337d3fd1da2aad7a080243cbdcb7 (2.4) |