Logo
›
›component›cherokee
Name
cherokee
Version
1.2.104+
Type
library
Description
Cherokee Web Server fast and secure
Licenses
GPL-2.0-only
PURL
-
CPE
cpe:2.3:*:*:cherokee_web_server:1.2.104+gitX:*:*:*:*:*:*:*

Other Versions#

Project
Branch
Version
yocto
scarthgap
1.2.104+git

Patches#

#
Title
Author
Resolve
1
Fix CVE-2020-12845 (#1243)
Stefan de Konink <stefan@konink.de>
CVE-2020-12845
2
make: Do not build po files
Khem Raj <raj.khem@gmail.com>
3
configure.ac: Add foreign to AM_INIT_AUTOMAKE
Khem Raj <raj.khem@gmail.com>
4
common-internal.h: Define LLONG_MAX if undefined
Khem Raj <raj.khem@gmail.com>
5
admin/Makefile.am: only install configured.py once
Robert Yang <liezhi.yang@windriver.com>

Vulnerabilities#

Name
Analysis
Description
CVE-2020-12845
Patched
Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. A remote unauthenticated attacker can crash the server by sending an HTTP request to protected resources using a malformed Authorization header that is mishandled during a cherokee_buffer_add call within cherokee_validator_parse_basic or cherokee_validator_parse_digest.