* [ANN] Rainbows! 0.91.1 - use a less-broken parser from Unicorn
@ 2010-04-19 21:24 7% Eric Wong
0 siblings, 0 replies; 1+ results
From: Eric Wong @ 2010-04-19 21:24 UTC (permalink / raw)
Rainbows! is an HTTP server for sleepy Rack applications. It is based on
Unicorn, but designed to handle applications that expect long
request/response times and/or slow clients. For Rack applications not
heavily bound by slow external network dependencies, consider Unicorn
instead as it simpler and easier to debug.
This release fixes a denial-of-service vector for deployments
exposed directly to untrusted clients.
The HTTP parser in Unicorn <= 0.97.0 would trip an assertion
(killing the associated worker process) on invalid
Content-Length headers instead of raising an exception. Since
Rainbows! and Zbatery supports multiple clients per worker
process, all clients connected to the worker process that hit
the assertion would be aborted.
Deployments behind nginx are _not_ affected by this bug, as
nginx will reject clients that send invalid Content-Length
The status of deployments behind other HTTP-aware proxies is
unknown. Deployments behind a non-HTTP-aware proxy (or no proxy
at all) are certainly affected by this DoS.
Users are strongly encouraged to upgrade as soon as possible,
there are no other changes besides this bug fix from Rainbows!
0.91.0 nor Unicorn 0.97.0
This bug affects all previously released versions of Rainbows!
Rainbows! mailing list - rainbows-talk-GrnCvJ7WPxnNLxjTenLetw@public.gmane.org
Do not quote signatures (like this one) or top post when replying
^ permalink raw reply [relevance 7%]
Results 1-1 of 1 | reverse results
2010-04-19 21:24 7% [ANN] Rainbows! 0.91.1 - use a less-broken parser from Unicorn Eric Wong
Rainbows! Rack HTTP server user/dev discussion
Archives are clonable:
git clone --mirror https://yhbt.net/rainbows-public
git clone --mirror http://ou63pmih66umazou.onion/rainbows-public
Example config snippet for mirrors
Newsgroups are available over NNTP:
note: .onion URLs require Tor: https://www.torproject.org/
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git