Vulnerability in lighttpd - TLS/SSL Protocol Issues
Summary
DSA-2626-1: lighttpd - several issues. Affects lighttpd versions < 1.4.28-2+squeeze1.2. Fixed in 1.4.28-2+squeeze1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lighttpd is a lightweight web server designed for speed, efficiency, and flexibility. It is commonly used to serve static and dynamic content over HTTP and HTTPS. lighttpd is vulnerable to multiple issues in the TLS/SSL protocol, which can lead to security breaches and unauthorized access to sensitive information.
Vulnerability Detail
The first vulnerability, identified as CVE-2009-3555, allows man-in-the-middle attackers to insert data into HTTPS sessions due to the improper association of renegotiation handshakes with existing connections in the TLS and SSLv3 protocols. This issue has been resolved in lighttpd by disabling client-initiated renegotiation by default.
The second vulnerability, known as CVE-2012-4929, involves a weakness in the TLS/SSL protocol when using compression. This vulnerability, named CRIME, enables eavesdroppers to gather information and recover the original plaintext. To mitigate this risk, compression has been disabled in lighttpd.
How To Fix
Minimum fixed version
1.4.28-2+squeeze1.2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lighttpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
Upgrading your lighttpd packages to the recommended versions will address the vulnerabilities in the TLS/SSL protocol. It is crucial to stay updated with security patches to ensure the integrity and confidentiality of your web server. If you require further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lighttpd →
FAQ
CVE-2009-3555 allows attackers to manipulate HTTPS sessions, potentially leading to unauthorized access to sensitive information.
CRIME is a side channel attack that exploits the compression feature in the TLS/SSL protocol to gather information and recover plaintext data.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by these vulnerabilities. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for open-source vulnerabilities.
Yes, if you have a specific need for client-initiated renegotiation, you can reenable it by modifying the ssl.disable-client-renegotiation parameter.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to upgrade to the fixed versions of lighttpd.
Related vulnerabilities
Recent vulnerabilities recorded for lighttpd.
