[SECURITY] Fedora 11 Update: boa-0.94.14-0.15.rc21.fc11

updates at fedoraproject.org updates at fedoraproject.org
Wed May 12 17:56:06 UTC 2010

Fedora Update Notification
2010-04-30 01:02:44

Name        : boa
Product     : Fedora 11
Version     : 0.94.14
Release     : 0.15.rc21.fc11
URL         : http://www.boa.org/
Summary     : Single-tasking HTTP server
Description :
Boa is a single-tasking HTTP server. That means that unlike traditional web
servers, it does not fork for each incoming connection, nor does it fork many
copies of itself to handle multiple connections. It internally multiplexes
all of the ongoing HTTP connections, and forks only for CGI programs (which
must be separate processes), automatic directory generation, and automatic
file gunzipping.
The primary design goals of Boa are speed and security. Security, in the sense
of "can't be subverted by a malicious user," not "fine grained access control
and encrypted communications". Boa is not intended as a feature-packed server.

Available rpmbuild rebuild options :
--with : debug access poll
--without : gunzip sendfile

Update Information:

This update fixes CVE-2009-4496 where HTTP request logs were written without
sanitizing non-printable characters.

* Wed Apr 28 2010 Matthias Saou <http://freshrpms.net/> 0.94.14-0.15.rc21
- Include escape-errorlog patch from Debian to fix CVE-2009-4496 (#583162).
* Tue Nov 24 2009 Matthias Saou <http://freshrpms.net/> 0.94.14-0.14.rc21
- Fix last minute init script breakage from the lat changes (#527582).
* Fri Jul 24 2009 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> - 0.94.14-0.13.rc21
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

  [ 1 ] Bug #583162 - CVE-2009-4496 boa: sanitize nonprintable characters in error logs

This update can be installed with the "yum" update program.  Use 
su -c 'yum update boa' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at

More information about the package-announce mailing list