CVE-2008-1531

Description

The connection_state_machine function (connections.c) in lighttpd 1.4.19 and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a denial of service (active SSL connection loss) by triggering an SSL error, such as disconnecting before a download has finished, which causes all active SSL connections to be lost.

4.3

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 2.30% Top 20%

Vendor Advisory debian.org Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory lighttpd.net Vendor Advisory lighttpd.net Vendor Advisory lighttpd.net Vendor Advisory lighttpd.net Vendor Advisory lighttpd.net

Affected: n/a n/a

References

Link	Tags
http://trac.lighttpd.net/trac/ticket/285#comment:21	vendor advisory
https://issues.rpath.com/browse/RPL-2407	broken link
https://bugs.gentoo.org/show_bug.cgi?id=214892	third party advisory
http://www.debian.org/security/2008/dsa-1540	third party advisory vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html	third party advisory vendor advisory
http://www.osvdb.org/43788	vdb entry broken link
http://trac.lighttpd.net/trac/changeset/2136	broken link vendor advisory
https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00562.html	third party advisory vendor advisory
http://security.gentoo.org/glsa/glsa-200804-08.xml	third party advisory vendor advisory
http://trac.lighttpd.net/trac/ticket/285#comment:18	vendor advisory
http://secunia.com/advisories/30023	third party advisory
http://secunia.com/advisories/29505	third party advisory
http://www.securityfocus.com/archive/1/490323/100/0/threaded	mailing list vdb entry third party advisory
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0132	third party advisory
http://www.securityfocus.com/bid/28489	vdb entry third party advisory
http://secunia.com/advisories/29636	third party advisory
http://www.vupen.com/english/advisories/2008/1063/references	vdb entry third party advisory
http://secunia.com/advisories/29544	third party advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/41545	vdb entry third party advisory
http://secunia.com/advisories/29649	third party advisory
http://trac.lighttpd.net/trac/changeset/2140	broken link vendor advisory
http://trac.lighttpd.net/trac/changeset/2139	broken link vendor advisory
https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00587.html	third party advisory vendor advisory

Frequently Asked Questions

What is the severity of CVE-2008-1531?: CVE-2008-1531 has been scored as a medium severity vulnerability.
How to fix CVE-2008-1531?: To fix CVE-2008-1531, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2008-1531 being actively exploited in the wild?: It is possible that CVE-2008-1531 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~2% probability that this vulnerability will be exploited by malicious actors in the next 30 days.