Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2014.0829
mod-wsgi security update
28 May 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: mod-wsgi
Publisher: Debian
Operating System: Debian GNU/Linux 6
Debian GNU/Linux 7
UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Increased Privileges -- Existing Account
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2014-0242 CVE-2014-0240
Original Bulletin:
http://www.debian.org/security/2014/dsa-2937
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running mod-wsgi check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-2937-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
May 27, 2014 http://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : mod-wsgi
CVE ID : CVE-2014-0240 CVE-2014-0242
Two security issues have been found in the Python WSGI adapter module
for Apache:
CVE-2014-0240
Robert Kisteleki discovered a potential privilege escalation in
daemon mode. This is not exploitable with the kernel used in Debian
7.0/wheezy.
CVE-2014-0242
Buck Golemon discovered that incorect memory handling could lead to
information disclosure when processing Content-Type headers.
For the oldstable distribution (squeeze), these problems have been fixed in
version 3.3-2+deb6u1.
For the stable distribution (wheezy), these problems have been fixed in
version 3.3-4+deb7u1.
For the testing distribution (jessie), these problems have been fixed in
version 3.5-1.
For the unstable distribution (sid), these problems have been fixed in
version 3.5-1.
We recommend that you upgrade your mod-wsgi packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBAgAGBQJThKJYAAoJEBDCk7bDfE42pQAP/1timmRSoJfdYXoYM/3wCeTH
CQGd9/4TmKeZc7bzWeaQfsLYfWgeicS+y3hPuZBMKdr4jX0r40AQ9j2zhiHG+WvM
jkpiLfuhvPpRY45Umll4xwRdfORpAr2ZN/H8ebohBOF6PAY4XZfr4tl0AgzqLPc+
s9wvff5vlDI5QBWuqWpXm4NXKlRtANqeTlPK3fvJJecJn74shv1PHpRqAVZzUA4J
KYaVrnIZFz5FQm8X2n+1VeAPaZb+UU/otqKdqkUit9lcld2nB6Zq1cqiFGO2sNVU
zO3aIj/nsrCJwIS2+3GhNAbjVbh9nz1c3ZAg0WFBr0CbrIHrA7mLIuHW3XYfXPKS
vF5JDxf6lnpRaJEEyoVUosm2fk3x/W8D91v4m1u92rgRSUF14nAv9XX745t8aZHn
VhzwFCwbaZgy0R2GbThs6rdAkVcKWNucCCX6WrjuEbp0HHCq8yEw7nkjCGY3lMj7
kRB6wm6iRcDIQCmClbLys/7Oq952TV6kLEs9XpD+rsyrHalkxqU/IZOhjwznLE3r
rCVZMrzlUPupgob2xnBc/688LnMIcq/UQkJCMqCHo7ER+lvVLoAc9o4yvMF76JSC
ZrbromVm51ZMFRuFD6kDjQFxrYBYt/QVAGeRrGCHkES8nm8l0x2g0QS61KXBh8V9
y+bcSiwTu8URJpnL32Ub
=wcoD
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBU4VkMBLndAQH1ShLAQJ0bxAAiX3ljF6biIXgdaJIAr5GFUcpdPYBugd4
eFf0CnR5ThiKm3m6XvqnPOyBhf/KGvCUWyzEyGEK/I2/kqMcpKdp2yJCufxYIJ5i
G6XUt+yEKAxkyTsJMn6TXEb54OoWAcbc8WomtlLyaQQTKrAKe6mXDodY5E9ufO6f
hk14WWUszIDYUj7ZUhB/LnkLo/UsJJOmkrcsJTYQ8Vdw/ew/A0cdN1KVhJDQyzWu
oz7RowuaCH/7BZIX2CJu8q5DLtykXVoy7PC9wNWn9XEcBUeSjaYJlcbj6WpDfudB
qED44IBQ/ILt2gqJm4hjb/yhbt+pci8VkxgBBSWW0OIZIn7QRDjaYfXSZ0KGKZ0W
2WrU4mcm6YhObI4MMp9yAS099DdUMA+Ecjw+8Uq9feBxKtWiNltKrY6oMVF86aPf
CYU4cLjuhrIYRCovziMy/IHPFxbM5NBJX4q0OhXuS6M/DJlg/gHAnTeyMqF90pyV
Uapj96gHeJusd2O4srxw793FARECT1x+nO+Z69dpf0axRPauPo2QnH2i9Ev6jVDA
/JaPaz4yVAl0Hgfal2EIdTeObfc80DFJuhhXTnVAeZgzsstuR6daaLMbdCfDT7tQ
GTfNWWSEiyI2sxxNnvwJGQ1LvkTu7GhM3MR6skaq94Un4JZpP/C6mkhwrbCVGfLt
jhQgp3VRYD4=
=Oatt
-----END PGP SIGNATURE-----