[SECURITY] Fedora 12 Update: boa-0.94.14-0.15.rc21.fc12

[updates at fedoraproject.org]

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2010-7640
2010-04-30 01:02:27
--------------------------------------------------------------------------------

Name        : boa
Product     : Fedora 12
Version     : 0.94.14
Release     : 0.15.rc21.fc12
URL         : http://www.boa.org/
Summary     : Single-tasking HTTP server
Description :
Boa is a single-tasking HTTP server. That means that unlike traditional web
servers, it does not fork for each incoming connection, nor does it fork many
copies of itself to handle multiple connections. It internally multiplexes
all of the ongoing HTTP connections, and forks only for CGI programs (which
must be separate processes), automatic directory generation, and automatic
file gunzipping.
The primary design goals of Boa are speed and security. Security, in the sense
of "can't be subverted by a malicious user," not "fine grained access control
and encrypted communications". Boa is not intended as a feature-packed server.

Available rpmbuild rebuild options :
--with : debug access poll
--without : gunzip sendfile

--------------------------------------------------------------------------------
Update Information:

This update fixes CVE-2009-4496 where HTTP request logs were written without
sanitizing non-printable characters.
--------------------------------------------------------------------------------
ChangeLog:

* Wed Apr 28 2010 Matthias Saou <http://freshrpms.net/> 0.94.14-0.15.rc21
- Include escape-errorlog patch from Debian to fix CVE-2009-4496 (#583162).
* Tue Nov 24 2009 Matthias Saou <http://freshrpms.net/> 0.94.14-0.14.rc21
- Fix last minute init script breakage from the lat changes (#527582).
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #583162 - CVE-2009-4496 boa: sanitize nonprintable characters in error logs
        https://bugzilla.redhat.com/show_bug.cgi?id=583162
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update boa' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------