-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2014:036 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : varnish Date : February 17, 2014 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Updated varnish packages fix security vulnerabilities: Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI (CVE-2013-4484). Also, the services have been converted from SysV init scripts to systemd-native services, which should allow for more consistent behavior. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4484 http://advisories.mageia.org/MGASA-2014-0065.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 6000b9509f578e6ea82e6d3b1644b4f2 mbs1/x86_64/lib64varnish1-3.0.3-0.2.mbs1.x86_64.rpm 815b13bbbdab794e2b93dc4506424d6c mbs1/x86_64/lib64varnish-devel-3.0.3-0.2.mbs1.x86_64.rpm 56decba0182e274354a9abb7b18432e6 mbs1/x86_64/varnish-3.0.3-0.2.mbs1.x86_64.rpm 677e6e2ed82db3e64b6ed07bf03258e3 mbs1/SRPMS/varnish-3.0.3-0.2.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFTAhKOmqjQ0CJFipgRAujTAKCGmfMzeDx9PxP7MKyrc9PFB6METwCeMxTj ctxFW9n8yI8AifPeqA0JVrY= =VqTb -----END PGP SIGNATURE-----
