• [SECURITY] [DSA 2937-1] mod-wsgi security update

    From Moritz Muehlenhoff@1:229/2 to All on Tue May 27 16:40:02 2014
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-2937-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff
    May 27, 2014 http://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : mod-wsgi
    CVE ID : CVE-2014-0240 CVE-2014-0242

    Two security issues have been found in the Python WSGI adapter module
    for Apache:

    CVE-2014-0240

    Robert Kisteleki discovered a potential privilege escalation in
    daemon mode. This is not exploitable with the kernel used in Debian
    7.0/wheezy.

    CVE-2014-0242

    Buck Golemon discovered that incorect memory handling could lead to
    information disclosure when processing Content-Type headers.

    For the oldstable distribution (squeeze), these problems have been fixed in version 3.3-2+deb6u1.

    For the stable distribution (wheezy), these problems have been fixed in
    version 3.3-4+deb7u1.

    For the testing distribution (jessie), these problems have been fixed in version 3.5-1.

    For the unstable distribution (sid), these problems have been fixed in
    version 3.5-1.

    We recommend that you upgrade your mod-wsgi packages.

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: http://www.debian.org/security/

    Mailing list: [email protected]
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1

    iQIcBAEBAgAGBQJThKJYAAoJEBDCk7bDfE42pQAP/1timmRSoJfdYXoYM/3wCeTH CQGd9/4TmKeZc7bzWeaQfsLYfWgeicS+y3hPuZBMKdr4jX0r40AQ9j2zhiHG+WvM jkpiLfuhvPpRY45Umll4xwRdfORpAr2ZN/H8ebohBOF6PAY4XZfr4tl0AgzqLPc+ s9wvff5vlDI5QBWuqWpXm4NXKlRtANqeTlPK3fvJJecJn74shv1PHpRqAVZzUA4J KYaVrnIZFz5FQm8X2n+1VeAPaZb+UU/otqKdqkUit9lcld2nB6Zq1cqiFGO2sNVU zO3aIj/nsrCJwIS2+3GhNAbjVbh9nz1c3ZAg0WFBr0CbrIHrA7mLIuHW3XYfXPKS vF5JDxf6lnpRaJEEyoVUosm2fk3x/W8D91v4m1u92rgRSUF14nAv9XX745t8aZHn VhzwFCwbaZgy0R2GbThs6rdAkVcKWNucCCX6WrjuEbp0HHCq8yEw7nkjCGY3lMj7 kRB6wm6iRcDIQCmClbLys/7Oq952TV6kLEs9XpD+rsyrHalkxqU/IZOhjwznLE3r rCVZMrzlUPupgob2xnBc/688LnMIcq/UQkJCMqCHo7ER+lvVLoAc9o4yvMF76JSC ZrbromVm51ZMFRuFD6kDjQFxrYBYt/QVAGeRrGCHkES8nm8l0x2g0QS61KXBh8V9 y+bcSiwTu8URJpnL32Ub
    =wcoD
    -----END PGP SIGNATURE-----


    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: https://lists.debian.org/[email protected]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)