ALT-PU-2023-6266: package libnghttp2 update to version 1.57.0-alt1
Описание
This update upgrades libnghttp2 to version 1.57.0-alt1.
Устраненные уязвимости4
Ссылки4
GHSA-m425-mq94-257g
https://github.com/advisories/GHSA-m425-mq94-257gGHSA-qppj-fm5r-hxr3
https://github.com/advisories/GHSA-qppj-fm5r-hxr3GHSA-xpw8-rcwv-8f8p
https://github.com/advisories/GHSA-xpw8-rcwv-8f8pСвязанные уязвимости
ALT-PU-2023-6264: package `libnghttp2` update to version 1.57.0-alt1
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
Envoy is a cloud-native high-performance edge/middle/service proxy. En ...