Candidate: CVE-2014-2323
PublicDate: 2014-03-14 15:55:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2323
 http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt
 http://www.openwall.com/lists/oss-security/2014/03/12/12
Description:
 SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35
 allows remote attackers to execute arbitrary SQL commands via the host
 name, related to request_check_hostname.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741493
 https://launchpad.net/bugs/1475265
Priority: medium
Discovered-by: Jann Horn
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]

Patches_lighttpd:
 upstream: http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.34_fix_mysql_injection.patch
upstream_lighttpd: released (1.4.33-1+nmu3)
lucid_lighttpd: ignored (reached end-of-life)
precise_lighttpd: ignored (reached end-of-life)
precise/esm_lighttpd: DNE (precise was needed)
quantal_lighttpd: ignored (reached end-of-life)
saucy_lighttpd: ignored (reached end-of-life)
trusty_lighttpd: released (1.4.33-1+nmu2ubuntu2.1)
trusty/esm_lighttpd: DNE (trusty was released [1.4.33-1+nmu2ubuntu2.1])
utopic_lighttpd: ignored (reached end-of-life)
vivid_lighttpd: not-affected (1.4.35-1ubuntu1)
vivid/stable-phone-overlay_lighttpd: DNE
vivid/ubuntu-core_lighttpd: DNE
wily_lighttpd: not-affected (1.4.35-1ubuntu1)
xenial_lighttpd: not-affected (1.4.35-1ubuntu1)
yakkety_lighttpd: not-affected (1.4.35-1ubuntu1)
zesty_lighttpd: not-affected (1.4.35-1ubuntu1)
artful_lighttpd: not-affected (1.4.35-1ubuntu1)
bionic_lighttpd: not-affected (1.4.35-1ubuntu1)
cosmic_lighttpd: not-affected (1.4.35-1ubuntu1)
devel_lighttpd: not-affected (1.4.35-1ubuntu1)