<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for lighttpd</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>openSUSE-SU-2022:10132-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2022-09-29T09:54:26Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2022-09-29T09:54:26Z</InitialReleaseDate>
    <CurrentReleaseDate>2022-09-29T09:54:26Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for lighttpd</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for lighttpd fixes the following issues:

lighttpd was updated to 1.4.66:

* a number of bug fixes
* Fix HTTP/2 downloads &gt;= 4GiB
* Fix SIGUSR1 graceful restart with TLS
* futher bug fixes
* CVE-2022-37797: null pointer dereference in mod_wstunnel,
  possibly a remotely triggerable crash (boo#1203358)
* In an upcoming release the TLS modules will default to using
  stronger, modern chiphers and will default to allow client
  preference in selecting ciphers.
  “CipherString” =&gt; “EECDH+AESGCM:AES256+EECDH:CHACHA20:SHA256:!SHA384”,
  “Options” =&gt; “-ServerPreference”
  old defaults:
  “CipherString” =&gt; “HIGH”,
  “Options” =&gt; “ServerPreference”
* A number of TLS options are how deprecated and will be removed
  in a future release:
  – ssl.honor-cipher-order
  – ssl.dh-file
  – ssl.ec-curve
  – ssl.disable-client-renegotiation
  – ssl.use-sslv2
  – ssl.use-sslv3
  The replacement option is ssl.openssl.ssl-conf-cmd, but lighttpd
  defaults should be prefered
* A number of modules are now deprecated and will be removed in a
  future release: mod_evasive, mod_secdownload, mod_uploadprogress,
  mod_usertrack can be replaced by mod_magnet and a few lines of lua.

update to 1.4.65:

* WebSockets over HTTP/2
* RFC 8441 Bootstrapping WebSockets with HTTP/2
* HTTP/2 PRIORITY_UPDATE
* RFC 9218 Extensible Prioritization Scheme for HTTP
* prefix/suffix conditions in lighttpd.conf
* mod_webdav safe partial-PUT
* webdav.opts += (“partial-put-copy-modify” =&gt; “enable”)
* mod_accesslog option: accesslog.escaping = “json”
* mod_deflate libdeflate build option
* speed up request body uploads via HTTP/2
* Behavior Changes
* change default server.max-keep-alive-requests = 1000 to adjust
* to increasing HTTP/2 usage and to web2/web3 application usage
* (prior default was 100)
* mod_status HTML now includes HTTP/2 control stream id 0 in the output
* which contains aggregate counts for the HTTP/2 connection
* (These lines can be identified with URL ‘*’, part of “PRI *” preface)
* alternative: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_status
* MIME type application/javascript is translated to text/javascript (RFC 9239)
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">openSUSE-2022-10132</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ATUOJQDWIRALBMVI5GOSOGPZP5AWVAZF/</URL>
      <Description>E-Mail link for openSUSE-SU-2022:10132-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1203358</URL>
      <Description>SUSE Bug 1203358</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-37797/</URL>
      <Description>SUSE CVE CVE-2022-37797 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Package Hub 15 SP3">
      <Branch Type="Product Name" Name="SUSE Package Hub 15 SP3">
        <FullProductName ProductID="SUSE Package Hub 15 SP3">SUSE Package Hub 15 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Package Hub 15 SP4">
      <Branch Type="Product Name" Name="SUSE Package Hub 15 SP4">
        <FullProductName ProductID="SUSE Package Hub 15 SP4">SUSE Package Hub 15 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="openSUSE Leap 15.3">
      <Branch Type="Product Name" Name="openSUSE Leap 15.3">
        <FullProductName ProductID="openSUSE Leap 15.3" CPE="cpe:/o:opensuse:leap:15.3">openSUSE Leap 15.3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="openSUSE Leap 15.4">
      <Branch Type="Product Name" Name="openSUSE Leap 15.4">
        <FullProductName ProductID="openSUSE Leap 15.4" CPE="cpe:/o:opensuse:leap:15.4">openSUSE Leap 15.4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="lighttpd-1.4.66-bp154.2.3.1">
      <FullProductName ProductID="lighttpd-1.4.66-bp154.2.3.1">lighttpd-1.4.66-bp154.2.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1">
      <FullProductName ProductID="lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1">lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1">
      <FullProductName ProductID="lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1">lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1">
      <FullProductName ProductID="lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1">lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1">
      <FullProductName ProductID="lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1">lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="lighttpd-mod_magnet-1.4.66-bp154.2.3.1">
      <FullProductName ProductID="lighttpd-mod_magnet-1.4.66-bp154.2.3.1">lighttpd-mod_magnet-1.4.66-bp154.2.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1">
      <FullProductName ProductID="lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1">lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1">
      <FullProductName ProductID="lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1">lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1">
      <FullProductName ProductID="lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1">
      <FullProductName ProductID="lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1">
      <FullProductName ProductID="lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1">
      <FullProductName ProductID="lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="lighttpd-mod_webdav-1.4.66-bp154.2.3.1">
      <FullProductName ProductID="lighttpd-mod_webdav-1.4.66-bp154.2.3.1">lighttpd-mod_webdav-1.4.66-bp154.2.3.1</FullProductName>
    </Branch>
    <Relationship ProductReference="lighttpd-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:lighttpd-1.4.66-bp154.2.3.1">lighttpd-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1">lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1">lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1">lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1">lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_magnet-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:lighttpd-mod_magnet-1.4.66-bp154.2.3.1">lighttpd-mod_magnet-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1">lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1">lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_webdav-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:lighttpd-mod_webdav-1.4.66-bp154.2.3.1">lighttpd-mod_webdav-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP4">
      <FullProductName ProductID="SUSE Package Hub 15 SP4:lighttpd-1.4.66-bp154.2.3.1">lighttpd-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP4">
      <FullProductName ProductID="SUSE Package Hub 15 SP4:lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1">lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP4">
      <FullProductName ProductID="SUSE Package Hub 15 SP4:lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1">lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP4">
      <FullProductName ProductID="SUSE Package Hub 15 SP4:lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1">lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP4">
      <FullProductName ProductID="SUSE Package Hub 15 SP4:lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1">lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_magnet-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP4">
      <FullProductName ProductID="SUSE Package Hub 15 SP4:lighttpd-mod_magnet-1.4.66-bp154.2.3.1">lighttpd-mod_magnet-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP4">
      <FullProductName ProductID="SUSE Package Hub 15 SP4:lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1">lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP4">
      <FullProductName ProductID="SUSE Package Hub 15 SP4:lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1">lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP4">
      <FullProductName ProductID="SUSE Package Hub 15 SP4:lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP4">
      <FullProductName ProductID="SUSE Package Hub 15 SP4:lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP4">
      <FullProductName ProductID="SUSE Package Hub 15 SP4:lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP4">
      <FullProductName ProductID="SUSE Package Hub 15 SP4:lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_webdav-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP4">
      <FullProductName ProductID="SUSE Package Hub 15 SP4:lighttpd-mod_webdav-1.4.66-bp154.2.3.1">lighttpd-mod_webdav-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:lighttpd-1.4.66-bp154.2.3.1">lighttpd-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1">lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1">lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1">lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1">lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_magnet-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:lighttpd-mod_magnet-1.4.66-bp154.2.3.1">lighttpd-mod_magnet-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1">lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1">lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_webdav-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:lighttpd-mod_webdav-1.4.66-bp154.2.3.1">lighttpd-mod_webdav-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.4">
      <FullProductName ProductID="openSUSE Leap 15.4:lighttpd-1.4.66-bp154.2.3.1">lighttpd-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.4">
      <FullProductName ProductID="openSUSE Leap 15.4:lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1">lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.4">
      <FullProductName ProductID="openSUSE Leap 15.4:lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1">lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.4">
      <FullProductName ProductID="openSUSE Leap 15.4:lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1">lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.4">
      <FullProductName ProductID="openSUSE Leap 15.4:lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1">lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_magnet-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.4">
      <FullProductName ProductID="openSUSE Leap 15.4:lighttpd-mod_magnet-1.4.66-bp154.2.3.1">lighttpd-mod_magnet-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.4">
      <FullProductName ProductID="openSUSE Leap 15.4:lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1">lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.4">
      <FullProductName ProductID="openSUSE Leap 15.4:lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1">lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.4">
      <FullProductName ProductID="openSUSE Leap 15.4:lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.4">
      <FullProductName ProductID="openSUSE Leap 15.4:lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.4">
      <FullProductName ProductID="openSUSE Leap 15.4:lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.4">
      <FullProductName ProductID="openSUSE Leap 15.4:lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1">lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4</FullProductName>
    </Relationship>
    <Relationship ProductReference="lighttpd-mod_webdav-1.4.66-bp154.2.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.4">
      <FullProductName ProductID="openSUSE Leap 15.4:lighttpd-mod_webdav-1.4.66-bp154.2.3.1">lighttpd-mod_webdav-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.</Note>
    </Notes>
    <CVE>CVE-2022-37797</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Package Hub 15 SP3:lighttpd-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:lighttpd-mod_magnet-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP3:lighttpd-mod_webdav-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP4:lighttpd-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP4:lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP4:lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP4:lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP4:lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP4:lighttpd-mod_magnet-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP4:lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP4:lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP4:lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP4:lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP4:lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP4:lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP4:lighttpd-mod_webdav-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.3:lighttpd-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.3:lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.3:lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.3:lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.3:lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.3:lighttpd-mod_magnet-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.3:lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.3:lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.3:lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.3:lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.3:lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.3:lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.3:lighttpd-mod_webdav-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.4:lighttpd-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.4:lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.4:lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.4:lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.4:lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.4:lighttpd-mod_magnet-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.4:lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.4:lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.4:lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.4:lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.4:lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.4:lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1</ProductID>
        <ProductID>openSUSE Leap 15.4:lighttpd-mod_webdav-1.4.66-bp154.2.3.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ATUOJQDWIRALBMVI5GOSOGPZP5AWVAZF/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-37797.html</URL>
        <Description>CVE-2022-37797</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1203358</URL>
        <Description>SUSE Bug 1203358</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
