Package: gunicorn Version: 0.14.3-1 Severity: grave Tags: security fixed-upstream
gunicorn 0.14 introduced the ability to check if a request line is too large to protect against DoS, however the implementation had the following flaws:
* Gunicorn does not limit the size of a request header (the limit_request_field_size configuration parameter is not used)
* When the configured request limit is lower than its maximum value, the maximum value is used instead. For instance if limit_request_line is set to 1024, gunicorn will only limit the request line to 4096 chars (this issue also affects limit_request_fields)
* Request limits are not limited to their maximum authorized values. For instance it is possible to set limit_request_line to 64K (this issue also affects limit_request_fields)
This has been fixed upstream in 0.14.4: https://github.com/benoitc/gunicorn/commit/d79ff999ce895e2ed0ea02aa8729e6da736dfc27 -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
