CVE-2022-22707

Secure, fast, compliant and very flexible web-server which has been optimized for high-performance environments. It has a very low memory footprint compared to other webservers and takes care of cpu-load. Its advanced feature-set (FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many more) make it the perfect webserver-software for every server that is suffering load problems.

Security Fix(es):

In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -1), as demonstrated by remote denial of service (daemon crash) in a non-default configuration. The non-default configuration requires handling of the Forwarded header in a somewhat unusual manner. Also, a 32-bit system is much more likely to be affected than a 64-bit system.(CVE-2022-22707)

In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -1), as demonstrated by remote denial of service (daemon crash) in a non-default configuration. The non-default configuration requires handling of the Forwarded header in a somewhat unusual manner. Also, a 32-bit system is much more likely to be affected than a 64-bit system.

In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -1), as demonstrated by remote denial of service (daemon crash) in a non-default configuration. The non-default configuration requires handling of the Forwarded header in a somewhat unusual manner. Also, a 32-bit system is much more likely to be affected than a 64-bit system.

In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -1), as demonstrated by remote denial of service (daemon crash) in a non-default configuration. The non-default configuration requires handling of the Forwarded header in a somewhat unusual manner. Also, a 32-bit system is much more likely to be affected than a 64-bit system. (CVE-2022-22707)

This update for lighttpd fixes the following issues:

lighttpd was updated to 1.4.64:

• CVE-2022-22707: off-by-one stack overflow in the mod_extforward plugin (boo#1194376)
• graceful restart/shutdown timeout changed from 0 (disabled) to 8 seconds. configure an alternative with: server.feature-flags += (“server.graceful-shutdown-timeout” => 8)
• deprecated modules (previously announced) have been removed: mod_authn_mysql, mod_mysql_vhost, mod_cml, mod_flv_streaming, mod_geoip, mod_trigger_b4_dl

update to 1.4.63:

• import xxHash v0.8.1
• fix reqpool mem corruption in 1.4.62

includes changes in 1.4.62:

• [mod_alias] fix use-after-free bug
• many developer visible bug fixes

update to 1.4.61:

• mod_dirlisting: sort '../' to top
• fix HTTP/2 upload > 64k w/ max-request-size
• code level and developer visible bug fixes

update to 1.4.60:

• HTTP/2 smoother and lower memory use (in general)
• HTTP/2 tuning to better handle aggressive client initial requests
• reduce memory footprint; workaround poor glibc behavior; jemalloc is better
• mod_magnet lua performance improvements
• mod_dirlisting performance improvements and new caching option
• memory constraints for extreme edge cases in mod_dirlisting, mod_ssi, mod_webdav
• connect(), write(), read() time limits on backends (separate from client timeouts)
• lighttpd restarts if large discontinuity in time occurs (embedded systems)
• RFC7233 Range support for all non-streaming responses, not only static files
• connect() to backend now has default 8 second timeout (configurable)

• Added hardening to systemd service(s) (boo#1181400).

update to 1.4.59:

• HTTP/2 enabled by default
• mod_deflate zstd suppport
• new mod_ajp13

Update to 1.4.58:

• [mod_wolfssl] use wolfSSL TLS version defines
• [mod_wolfssl] compile with earlier wolfSSL vers
• [core] prefer IPv6+IPv4 func vs IPv4-specific func
• [core] reuse large mem chunks (fix mem usage) (fixes #3033)
• [core] add comment for FastCGI mem use in hctx->rb (#3033)
• [mod_proxy] fix sending of initial reqbody chunked
• [multiple] fdevent_waitpid() wrapper
• [core] sys-time.h - localtime_r,gmtime_r macros
• [core] http_date.[ch] encapsulate HTTP-date parse
• [core] specialized strptime() for HTTP date fmts
• [multiple] employ http_date.h, sys-time.h
• [core] http_date_timegm() (portable timegm())
• buffer_append_path_len() to join paths
• [core] inet_ntop_cache -> sock_addr_cache
• [multiple] etag.[ch] -> http_etag.[ch]; better imp
• [core] fix crash after specific err in config file
• [core] fix bug in FastCGI uploads (#3033)
• [core] http_response_match_if_range()
• [mod_webdav] typedef off_t loff_t for FreeBSD
• [multiple] chunkqueue_write_chunk()
• [build] add GNUMAKEFLAGS=--no-print-directory
• [core] fix bug in read retry found by coverity
• [core] attempt to quiet some coverity warnings
• [mod_webdav] compile fix for Mac OSX/11
• [core] handle U+00A0 in config parser
• [core] fix lighttpd -1 one-shot with pipes
• [core] quiet start/shutdown trace in one-shot mode
• [core] allow keep-alives in one-shot mode (#3042)
• [mod_webdav] define _ATFILE_SOURCE if AT_FDCWD
• [core] setsockopt IPV6_V6ONLY if server.v4mapped
• [core] prefer inet_aton() over inet_addr()
• [core] add missing mod_wolfssl to ssl compat list
• [mod_openssl] remove ancient preprocessor logic
• [core] SHA512_Init, SHA512_Update, SHA512_Final
• [mod_wolfssl] add complex preproc logic for SNI
• [core] wrap a macro value with parens
• [core] fix handling chunked response from backend (fixes #3044)
• [core] always set file.fd = -1 on FILE_CHUNK reset (fixes #3044)
• [core] skip some trace if backend Upgrade (#3044)
• [TLS] cert-staple.sh POSIX sh compat (fixes #3043)
• [core] portability fix if st_mtime not defined
• [mod_nss] portability fix
• [core] warn if mod_authn_file needed in conf
• [core] fix chunked decoding from backend (fixes #3044)
• [core] reject excess data after chunked encoding (#3046)
• [core] track chunked encoding…

These are all security issues fixed in the lighttpd-1.4.64-1.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that lighttpd incorrectly handled certain inputs, which could result in a stack buffer overflow. A remote attacker could possibly use this issue to cause a denial of service (DoS). (CVE-2022-22707, CVE-2022-41556)