[v3.2] lighttpd: Log injection vulnerability in mod_auth (CVE-2015-3200)
When basic HTTP authentication base64 string does not contain colon character (or contains it after NULL byte - can be inserted inside base64 encoding), then that ituation is logged with a string “: is missing in ” and the simply decoded base64 string. This means that new lines, NULL byte and everything else can be encoded with base64 and are then inserted to logs as they are after decoding.
Reference: http://redmine.lighttpd.net/issues/2646
https://security-tracker.debian.org/tracker/CVE-2015-3200
(from redmine: issue id 4330, created on 2015-06-15, closed on 2019-05-03)
- Relations:
- parent #4329
- Changesets:
- Revision a7cd05c2 by Natanael Copa on 2015-07-07T14:23:40Z:
main/lighttpd: security fix for CVE-2015-3200
The upstream patch does not apply without applying lot other stuff so we
simply apply all since 1.4.35 release.
fixes #4330
(cherry picked from commit c1ee7a6e6d21447788c7512e7197d49ebfbc3096)