UnrealIRCd 6.2.7 released & hot-patch to fix security issues for existing installations

[Syzop]

Hi everyone,

As promised, here is the 6.2.7 release and the hot-patch to fix the issues without restart:

This UnrealIRCd 6.2.7 release fixes multiple issues in the webserver module which allow an attacker to consume a lot of memory and stall the IRCd. If you use Websockets or JSON-RPC then we recommend to either upgrade or hot-patch.

A good strategy may be to hot-patch now to fix the most urgent issue and plan an upgrade to 6.2.7 at a more convenient time in the upcoming weeks.

Fix without restart
The hot-patch allows you to update the server without a restart on UnrealIRCd 6.2.x and may also work on older (unsupported) versions. To do so, run:

Code: Select all

./unrealircd hot-patch webserver-header-dos

Or upgrade to the complete 6.2.7 release (with restart)
Note that the hot-patch only fixes the issues mentioned above. This 6.2.7 release contains other fixes and enhancements as well! You can read all about it in the release notes.

You can download UnrealIRCd from unrealircd.org. On *NIX you can upgrade to 6.2.7 (requires a restart) with the command:

Code: Select all

./unrealircd upgrade