Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:03273-1

Опубликовано: 19 сент. 2025
Источник: suse-cvrf

Описание

Security update for python-h2

This update for python-h2 fixes the following issues:

  • CVE-2025-57804: Fixed HTTP Request Smuggling due to illegal characters in headers (bsc#1248737)

Список пакетов

SUSE Linux Enterprise Module for Server Applications 15 SP6
python3-h2-3.2.0-150200.3.5.1
SUSE Linux Enterprise Module for Server Applications 15 SP7
python3-h2-3.2.0-150200.3.5.1

Ссылки

Описание

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.

Затронутые продукты
SUSE Linux Enterprise Module for Server Applications 15 SP6:python3-h2-3.2.0-150200.3.5.1
SUSE Linux Enterprise Module for Server Applications 15 SP7:python3-h2-3.2.0-150200.3.5.1
Ссылки