diff options
author | Eric Wong <normalperson@yhbt.net> | 2010-04-19 13:47:29 -0700 |
---|---|---|
committer | Eric Wong <normalperson@yhbt.net> | 2010-04-19 13:47:29 -0700 |
commit | 3d0558d7c80c63bab48eb561fdb7e3d580428b01 (patch) | |
tree | bd0595db29dea2d8c67e4410367ebc218b40fbe0 /GIT-VERSION-GEN | |
parent | d5d5658b927798c9f5c4aab9808c3c4386a51f14 (diff) | |
download | rainbows-3d0558d7c80c63bab48eb561fdb7e3d580428b01.tar.gz |
This release fixes a denial-of-service vector for deployments exposed directly to untrusted clients. The HTTP parser in Unicorn <= 0.97.0 would trip an assertion (killing the associated worker process) on invalid Content-Length headers instead of raising an exception. Since Rainbows! and Zbatery supports multiple clients per worker process, all clients connected to the worker process that hit the assertion would be aborted. Deployments behind nginx are _not_ affected by this bug, as nginx will reject clients that send invalid Content-Length headers. The status of deployments behind other HTTP-aware proxies is unknown. Deployments behind a non-HTTP-aware proxy (or no proxy at all) are certainly affected by this DoS. Users are strongly encouraged to upgrade as soon as possible, there are no other changes besides this bug fix from Rainbows! 0.91.0 nor Unicorn 0.97.0 This bug affects all previously released versions of Rainbows! and Zbatery.
Diffstat (limited to 'GIT-VERSION-GEN')
-rwxr-xr-x | GIT-VERSION-GEN | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/GIT-VERSION-GEN b/GIT-VERSION-GEN index 366063e..95d54f9 100755 --- a/GIT-VERSION-GEN +++ b/GIT-VERSION-GEN @@ -1,7 +1,7 @@ #!/bin/sh GVF=GIT-VERSION-FILE -DEF_VER=v0.91.0.GIT +DEF_VER=v0.91.1.GIT LF=' ' |