Categories
Nginx

Nginx 1.2.0 with Naxsi 0.45 and Passenger 3.0.12

Dotdeb’s packages of the long-awaited Nginx 1.2.0 are now available for Debian 6.0 “Squeeze” (amd64/i386) in five flavors : nginx-light, nginx-naxsi, nginx-full, nginx-passenger and nginx-extras.

This is a major release with a lot of improvements since the former 1.0 branch. Please take a look at Nginx’ official Changelog before upgrading.

On the Dotdeb side :

  • Naxsi, a high performance, low rules maintenance, Web Application Firewall module, has been upgraded to its 0.45 version. Please read its documentation fore more info.
  • Passenger has been upgraded to its 3.0.12 version.
  • Because nginx-passenger is now dedicated to Passenger, nginx-extras does not contain it anymore. Don’t forget to backup your configuration files when switching from nginx-extras to nginx-passenger.

If you want to know which module has been included in each Nginx flavor, you just have to look at this useful document.

Categories
Passenger

Passenger 3.0.12

Packages of Passenger 3.0.12 are now available for Debian 6.0 “Squeeze” on both amd64 and i386 architectures.

Here is the announcement from Phusion’s blog :

Phusion Passenger is an Apache and Nginx module for deploying Ruby web applications. It has a strong focus on ease of use, stability and performance. Phusion Passenger is built on top of tried-and-true, battle-hardened Unix technologies, yet at the same time introduces innovations not found in most traditional Unix servers. Since version 3.0 it can also run standalone without an external web server, making it not only easier for first-time users but also ideal on development environments.

Recent changes

Phusion Passenger is under constant maintenance and development. We are pleased to announce Phusion Passenger version 3.0.12. This is a bug fix release.

  • [Apache] Support Apache 2.4. The event MPM is now also supported.
  • [Nginx] Preferred Nginx version upgraded to 1.0.15.
  • [Nginx] Preferred PCRE version upgraded to 8.30.
  • [Nginx] Fixed compatibility with Nginx < 1.0.10.
  • [Nginx] Nginx is now installed with http_gzip_static_module by default.
  • [Nginx] Fixed a memory disclosure security problem.
    The issue is documented at http://www.nginx.org/en/security_advisories.html and affects more modules than just Phusion Passenger. Users are advised to upgrade as soon as possible. Patch submitted by Gregory Potamianos.
  • [Nginx] passenger_show_version_in_header now hides the Phusion Passenger version number from the ‘Server:’ header too.Patch submitted by Gregory Potamianos.
  • Fixed a /proc deprecation warning on Linux kernel >= 3.0.
Categories
Redis

Redis 2.4.11

Redis 2.4.11 has been released with these changes :

  • [BUGFIX] Fixed a problem with aeWait() implementation. May cause a crash under non easy to replicate condiitons. See issue #267 on github.
  • [BUGFIX] SORT with GET/BY option fetching expiring keys fixed. Issue #460.
  • [BUGFIX] INFO field master_link_down_since_seconds initialized correctly.
  • [FEATURE] redis-cli back ported from Redis unstable. Now has support for --bigkeys (to sample the DB for very large keys), --slave to simulate a slave instance.

The upgrade urgency is moderate if you don’t experience any of the fixed problems.

The packages of Redis 2.4.11 are now available for Debian 6.0 “Squeeze” on both amd64 and i386 architectures.

Categories
MySQL

MySQL 5.5.23

The packages of MySQL 5.5.23 are now available for Debian 6.0 “Squeeze” on both amd64 and i386 architectures with no major change except bug fixes.

As usual, please read carefully the full Changelog before upgrading.

Categories
MySQL

Percona toolkit 2.1.1

Percona toolkit 2.1.1 is now available on Dotdeb for Debian 6.0 “Squeeze”. You’ll find its Changelog here.

2.1 introduces a lot of new code for:

  • pt-online-schema-change (completely redesigned)
  • pt-mysql-summary (completely redesigned)
  • pt-summary (completely redesigned)
  • pt-fingerprint (new tool)
  • pt-table-usage (new tool)

Baron Schwartz also wrote a blog post that presents pt-online-schema-change, a new and useful online schema change tool.

Categories
Nginx

Security : Nginx 1.0.15

Nginx 1.0.15 packages are now available for Debian 6.0 “Squeeze” on both amd64 and i386 architectures. They fix a buffer overflow in the ngx_http_mp4_module :

  • Security: specially crafted mp4 file might allow to overwrite memory locations in a worker process if the ngx_http_mp4_module was used, potentially resulting in arbitrary code execution (CVE-2012-2089). Thanks to Matthew Daley.
  • Bugfix: in the ngx_http_mp4_module.

Upgrading is recommended if you’re using the nginx-extras packages.

Categories
Nginx Passenger

Nginx with 2 new flavors : Naxsi & Passenger

Dotdeb’s packages of Nginx 1.0.14 for Debian 6.0 “Squeeze” (amd64/i386) have been synchronized with Debian’s ones to benefit from the great work of Cyril Lavier.

As a consequence, two new flavors of Nginx are now available, in addition to the regular nginx-light, nginx-full and nginx-extras packages :

  • nginx-naxsi inherits from nginx-light with a great new feature : Naxsi, a high performance, low rules maintenance, Web Application Firewall module. Use it if you want to protect your web apps from malicious visitors. Please read its documentation fore more info.
  • nginx-passenger is dedicated to Passenger, the well-known Ruby on Rails runtime. Please also note that :
    • the passenger-common package has been renamed to ruby-passenger to stick to the Debian naming convention,
    • Passenger was already included in nginx-extras. To ease the migration (don’t forget to backup your configuration files), it will stay so until Nginx 1.2 is released.

If you want to know which module has been included in each Nginx flavor, you just have to look at this useful document.

Oh… One more thing : all the Nginx packages are now hardened against memory corruption attacks (no PIE support yet).

I really hope you’ll enjoy them. And many thanks to the Debian maintainers for their work, of course.

Categories
Redis

Redis 2.4.10

Redis 2.4.10 has been released with these changes :

  • [FEATURE] Redis –test-meory improved with new test testing addressing.
  • [BUGFIX] Fixed a memory leak: happens when replication is used with DB > 9.
  • [BUGFIX] Fixed a replication bug that happens in chained replicaiton when a slave is attached to a master that is later turned into a slave. Now the chained slave reconnection is properly forced.

The upgrade urgency is high for users using replication with a DB identifier higher than 9, or chaining replication so that slaves are attached to other slaves. It’s low for all the other users.

The packages of Redis 2.4.10 are now available for Debian 6.0 “Squeeze” on both amd64 and i386 architectures.

Categories
MySQL

MySQL 5.5.22

The packages of MySQL 5.5.22 are now available for Debian 6.0 “Squeeze” on both amd64 and i386 architectures with no major change except bug fixes.

As usual, please read carefully the full Changelogs of MySQL 5.5.21 and MySQL 5.5.22 before upgrading.

Categories
Redis

Redis 2.4.9

Redis 2.4.9 has been released with these changes :

  • [FEATURE] Redis server is now able to test your memory for broken RAM. Usage: ./redis-server –test-memory.
  • [FEATURE] redis-benchmark backported from unstable. Pipelining, run selected tests, and a few more features.
  • [BUGFIX] utils/install_server.sh script now works on Redhat / Centos.
  • [BUGFIX] Minor fix to redis-cli (github issue #306).

The packages of Redis 2.4.9 are now available for Debian 6.0 “Squeeze” on both amd64 and i386 architectures. They now supports higher than 922 values of maxclients, thanks to @jbfavre.