From 3ce92574b356e4cb054b1291e1f035173420f12a Mon Sep 17 00:00:00 2001 From: Eric Wong Date: Mon, 19 Apr 2010 13:50:40 -0700 Subject: unicorn 0.97.1 - fix HTTP parser for Rainbows!/Zbatery This release fixes a denial-of-service vector for derived servers exposed directly to untrusted clients. This bug does not affect most Unicorn deployments as Unicorn is only supported with trusted clients (such as nginx) on a LAN. nginx is known to reject clients that send invalid Content-Length headers, so any deployments on a trusted LAN and/or behind nginx are safe. Servers affected by this bug include (but are not limited to) Rainbows! and Zbatery. This bug does not affect Thin nor Mongrel, as neither got the request body filtering treatment that the Unicorn HTTP parser got in August 2009. The bug fixed in this release could result in a denial-of-service as it would trigger a process-wide assertion instead of raising an exception. For servers such as Rainbows!/Zbatery that serve multiple clients per worker process, this could abort all clients connected to the particular worker process that hit the assertion. --- GIT-VERSION-GEN | 2 +- lib/unicorn/const.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/GIT-VERSION-GEN b/GIT-VERSION-GEN index 1e6f505..9142570 100755 --- a/GIT-VERSION-GEN +++ b/GIT-VERSION-GEN @@ -1,7 +1,7 @@ #!/bin/sh GVF=GIT-VERSION-FILE -DEF_VER=v0.97.0.GIT +DEF_VER=v0.97.1.GIT LF=' ' diff --git a/lib/unicorn/const.rb b/lib/unicorn/const.rb index 647a038..41c02d6 100644 --- a/lib/unicorn/const.rb +++ b/lib/unicorn/const.rb @@ -7,7 +7,7 @@ module Unicorn # gave about a 3% to 10% performance improvement over using the strings directly. # Symbols did not really improve things much compared to constants. module Const - UNICORN_VERSION="0.97.0" + UNICORN_VERSION="0.97.1" DEFAULT_HOST = "0.0.0.0" # default TCP listen host address DEFAULT_PORT = 8080 # default TCP listen port -- cgit v1.2.3-24-ge0c7