OpenLiteSpeed 1.8.3 released - fix lsquic hash flood, support 100 continue. - Enhance Control Panel

OpenLiteSpeed 1.8.3 released - fix lsquic hash flood, support 100 continue.

DracoBlue

[Security] Update lsquic to address hash flood vulnerability
[New Feature] Add support for "expect: 100 continue" handling.
[Improvement] Log HTTP/3 in access log
[Bug Fix] Block requests with “Transfer-Encoding”, then “Content-length” headers.
[Bug Fix] Run Ruby/python/nodes application server in detached mode.
[Bug Fix] Address SSL client authentication bypass.
[Bug Fix] Address corner case in HTTP authentication required user list.

xyzulu

DracoBlue if you do insist on constantly re-posting changelogs, probably best to include a link, ie https://openlitespeed.org/release-log/version-1-8-x/

I have seen ols in the past taking a while after they publish changelogs to push things to their repo. Perhaps a better thing to share @DracoBlue is the update notification once you have installed it.

AdamM

@Adam, any instructions on how to perform OpenLiteSpeed updates in v12?

Adam

Once they publish the package to their apt repository you can just run "apt upgrade".

AdamM

Adam Great, so you no longer have to do it manually

Kosta

Should be possible to upgrade by:

cd /usr/local/lsws/admin/misc/

And running:
./lsup.sh -v 1.8.3

AdamM

Kosta Yes, I saw that but I'm not sure if it won't break something in enhance. @Adam can you confirm that such an update is safe?

AdamM

What's this cyberpanel crap?
@cPFence @Adam is it safe?
https://i.ibb.co/Tqqc8xT3/update-openlitespeed.png

Kosta

AdamM should be safe it’s coming from openlitespeed www, that’s how I updated my LSE and OLS on my cluster. Well I hope so

cPFence

AdamM

You’re using the official built-in upgrade script, and the URL https://cyberpanel.sh/?ip is just used to fetch and save the IP, so it’s safe to use. But it’s better to wait until they publish the package to their APT repository anyway.