Your submission was sent successfully! Close

CVE-2015-0228

Published: 16 February 2015

The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.

Notes

AuthorNote
mdeslaur
mod_lua is in 2.4.x only
mod_lua isn't built in trusty
Priority

Low

Status

Package Release Status
apache2
Launchpad, Ubuntu, Debian
lucid Not vulnerable
(2.2.14-5ubuntu8.14)
precise Not vulnerable
(2.2.22-1ubuntu1.7)
trusty Not vulnerable
(code not built)
upstream Needs triage

utopic
Released (2.4.10-1ubuntu1.1)
Patches:
upstream: https://github.com/apache/httpd/commit/643f0fcf3b8ab09a68f0ecd2aa37aafeda3e63ef
upstream: https://github.com/apache/httpd/commit/1f1375a2a615337d3fd1da2aad7a080243cbdcb7 (2.4)