Pound is vulnerable to HTTP request smuggling, which could be exploited to bypass security restrictions or poison web caches.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-servers/pound | * | < 2.0.5 | >= 2.0.5, >= 1.10 (revision), >= 1.9.4 (revision) |
Pound is a reverse proxy, load balancer and HTTPS front-end. It allows to distribute the load on several web servers and offers a SSL wrapper for web servers that do not support SSL directly.
Pound fails to handle HTTP requests with conflicting "Content-Length" and "Transfer-Encoding" headers correctly.
An attacker could exploit this vulnerability by sending HTTP requests with specially crafted "Content-Length" and "Transfer-Encoding" headers to bypass certain security restrictions or to poison the web proxy cache.
There is no known workaround at this time.
All Pound users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose www-servers/pound
Pound is vulnerable to a buffer overflow that could lead to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-servers/pound | * | < 1.8.3 | >= 1.8.3 |
Pound is a reverse proxy, load balancer and HTTPS front-end.
Steven Van Acker has discovered a buffer overflow vulnerability in the "add_port()" function in Pound.
A remote attacker could send a request for an overly long hostname parameter, which could lead to the remote execution of arbitrary code with the rights of the Pound daemon process (by default, Gentoo uses the "nobody" user to run the Pound daemon).
There is no known workaround at this time.
All Pound users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/pound-1.8.3"
There is a format string flaw in Pound, allowing remote execution of arbitrary code with the rights of the Pound process.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-servers/pound | * | <= 1.5 | >= 1.6 |
Pound is a reverse proxy, load balancer and HTTPS front-end. It allows to distribute the load on several web servers and offers a SSL wrapper for web servers that do not support SSL directly.
A format string flaw in the processing of syslog messages was discovered and corrected in Pound.
This flaw may allow remote execution of arbitrary code with the rights of the Pound daemon process. By default, Gentoo uses the "nobody" user to run the Pound daemon.
There is no known workaround at this time. All users are advised to upgrade to the latest available version of Pound.
All users of Pound should upgrade to the latest stable version:
# emerge sync # emerge -pv ">=www-servers/pound-1.6" # emerge ">=www-servers/pound-1.6"