[Debian] CVE: CVE-2022-41556/CVE-2022-30780: Lighttpd : multiple CVEs Edit

[Yue Tao]

CVE-2022-41556: [https://nvd.nist.gov/vuln/detail/CVE-2022-41556]
A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example, affected. This is fixed in 1.4.67.

CVE-2022-30780: [https://nvd.nist.gov/vuln/detail/CVE-2022-30780]
Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers.

Score:
cve_id status cvss3Score av ac pr ui ai
CVE-2022-41556 fixed 7.5 N L N N H
CVE-2022-30780 fixed 7.5 N L N N H

References:
https://security-tracker.debian.org/tracker/CVE-2022-41556
https://security-tracker.debian.org/tracker/CVE-2022-30780

[lighttpd_1.4.59-1+deb11u2]

[Yue Tao (wrytao)]

CVE-2022-41556: introduced by: https://github.com/lighttpd/lighttpd1.4/commit/bcddbe186f010e2964f7551141c0b8350b36817d, which isn't in current version.

CVE-2022-30780: introduced by: https://github.com/lighttpd/lighttpd1.4/commit/ec2ff2c6ae70f150cfb7e35b77344c16af87c862, which isn't in current version