Lighttpd 1.4.34 发布，高性能 Web 服务器

Lighttpd 1.4.34 发布，该版本包含一些重要的安全补丁，包括：

• lighttpd SA-2013-01 (CVE-2013-4508)
• lighttpd SA-2013-02 (CVE-2013-4559)
• lighttpd SA-2013-03 (CVE-2013-4560)

下载地址：

• lighttpd-1.4.34.tar.gz (GPG signature)
  • SHA256: 468f8bbe7bac9d294c79d6454cd97990c13191b270c21b7c4e398936713b2642
• lighttpd-1.4.34.tar.bz2 (GPG signature)
  • SHA256: e4b5682ef21b0bdea4a18dc7ccac6b5a0bf526b691ad0fe5c25c8b9fc38d0c12
• lighttpd-1.4.34.tar.xz (GPG signature)
  • SHA256: 3e067bd12a6c953862139f0ee4cb03a0cd8cff9b3ffe393ddc7dc3956431cb72
• SHA256 checksums

Changes from 1.4.33

• [mod_auth] explicitly link ssl for SHA1 (fixes #2517)
• [mod_extforward] fix compilation without IPv6, (not) using undefined var (fixes #2515, thx mm)
• [ssl] fix SNI handling; only use key+cert from SNI specific config (fixes #2525, CVE-2013-4508)
• [doc] update ssl.cipher-list recommendation
• [stat-cache] FAM: fix use after free (CVE-2013-4560)
• [stat-cache] fix FAM cleanup/fdevent handling
• [core] check success of setuid,setgid,setgroups (CVE-2013-4559)
• [ssl] fix regression from CVE-2013-4508 (client-cert sessions were broken)
• maintain physical.basedir (the “acting” doc-root as prefix of physical.path) in more places
• [core] decode URL before rewrite, enabling it to work in $HTTP[“url”] conditionals (fixes#2526)
• [auto* build] remove -no-undefined from linker flags, as we actually link modules with undefined symbols (fixes #2533)
• [mod_mysql_vhost] fix memory leak on config init (#2530)
• [mod_webdav] fix fd leak found with parfait (fixes #2530, thx kukackajiri)