31f09f54a6
* Improved HTTPS cipher handling and added support for chained certificates. * Allow the source password to be undefined. There was a corner case, where a default password would have taken effect. It would require the admin to remove the 'source-password' from the icecast config to take effect. Default configs ship with the password set, so this vulnerability doesn't trigger there. * Prevent error log injection of control characters by substituting non-alphanumeric characters with a '.' (CVE-2011-4612). Injection attempts can be identified via access.log, as that stores URL encoded requests. Investigation if further logging code needs to have sanitized output is ongoing. Tested on amd64. Reads fine aja@
3 lines
115 B
Plaintext
3 lines
115 B
Plaintext
SHA256 (icecast-2.3.3.tar.gz) = Gx0G9fg8mpg80ozHiqkOQDj5M1EbPSDX/Sz8EWZFw20=
|
|
SIZE (icecast-2.3.3.tar.gz) = 1161774
|