OpenLiteSpeed 1.8.3 released - fix lsquic hash flood, support 100 continue. - Enhance Control Panel

OpenLiteSpeed 1.8.3 released - fix lsquic hash flood, support 100 continue.

DracoBlue

[Security] Update lsquic to address hash flood vulnerability
[New Feature] Add support for "expect: 100 continue" handling.
[Improvement] Log HTTP/3 in access log
[Bug Fix] Block requests with “Transfer-Encoding”, then “Content-length” headers.
[Bug Fix] Run Ruby/python/nodes application server in detached mode.
[Bug Fix] Address SSL client authentication bypass.
[Bug Fix] Address corner case in HTTP authentication required user list.

xyzulu

DracoBlue if you do insist on constantly re-posting changelogs, probably best to include a link, ie https://openlitespeed.org/release-log/version-1-8-x/

I have seen ols in the past taking a while after they publish changelogs to push things to their repo. Perhaps a better thing to share @DracoBlue is the update notification once you have installed it.

AdamM

@Adam, any instructions on how to perform OpenLiteSpeed updates in v12?

Adam

Once they publish the package to their apt repository you can just run "apt upgrade".

AdamM

Adam Great, so you no longer have to do it manually

Kosta

Should be possible to upgrade by:

cd /usr/local/lsws/admin/misc/

And running:
./lsup.sh -v 1.8.3

AdamM

Kosta Yes, I saw that but I'm not sure if it won't break something in enhance. @Adam can you confirm that such an update is safe?

AdamM

What's this cyberpanel crap?
@cPFence @Adam is it safe?
https://i.ibb.co/Tqqc8xT3/update-openlitespeed.png

Kosta

AdamM should be safe it’s coming from openlitespeed www, that’s how I updated my LSE and OLS on my cluster. Well I hope so

cPFence

AdamM

You’re using the official built-in upgrade script, and the URL https://cyberpanel.sh/?ip is just used to fetch and save the IP, so it’s safe to use. But it’s better to wait until they publish the package to their APT repository anyway.

slimx

AdamM @LordKurgan waiting for your comment 🙂

josedieguez

AdamM found some issues connecting to cyberpanel (not on Enhance servers) and took the case to LiteSpeedtech.

they have confirmed their install script at least, connects to cyberpanel for IP verification.. terrible idea.

it's not bad, and should be safe.

but i don't trust cyberpanel, and they even had /have blocked some of our ips. LOL, so we had issues trying to install LSWS on brand new server.

[deleted]

slimx Ahead of you in the rankings.. so keep laughing Mr. Web V8 not so slim 😂😂😂

Kosta

Be advised do not update OLS or LSE on production ready cluster using lsup.sh to their latest version that are not yet on their repo as they are not stable or causing some problems…. I experienced this and reported to enhance support to have a look about it.

MDG

Whats the upgrade command? @ 🧐 ![]
root@U ~ # openlitespeed -v
openlitespeed: command not found
root@U~ # /usr/local/lsws/bin/openlitespeed -v
LiteSpeed/1.8.2 Open (BUILD built: Fri Dec 20 16:39:15 UTC 2024)
module versions:
lsquic 4.0.8
modgzip 1.1
cache 1.66
mod_security 1.4 (with libmodsecurity v3.0.13)

root@ ~ # ./lsup.sh -v 1.8.3
-bash: ./lsup.sh: No such file or directory
root@ ~ # sudo apt-get install openlitespeed=1.8.3
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Package openlitespeed is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source

E: Version '1.8.3' for 'openlitespeed' was not found
root@~ # sudo dpkg -i openlitespeed-1.8.3_x86_64.deb
dpkg: error: cannot access archive 'openlitespeed-1.8.3_x86_64.deb': No such file or directory

pratik_asabe

MDG what exactly are you doing? do you usually this much reckless with your prod servers?

DracoBlue

MDG https://docs.openlitespeed.org/installation/upgrade/

MDG

pratik_asabe just test server lol