Π›ΠΎΠ³ΠΎΡ‚ΠΈΠΏ exploitDog
Консоль
Π›ΠΎΠ³ΠΎΡ‚ΠΈΠΏ exploitDog

exploitDog

suse-cvrf Π»ΠΎΠ³ΠΎΡ‚ΠΈΠΏ

openSUSE-SU-2021:0468-1

ΠžΠΏΡƒΠ±Π»ΠΈΠΊΠΎΠ²Π°Π½ΠΎ: 25 ΠΌΠ°Ρ€. 2021
Π˜ΡΡ‚ΠΎΡ‡Π½ΠΈΠΊ: suse-cvrf

ОписаниС

Security update for nghttp2

This update for nghttp2 fixes the following issues:

  • CVE-2020-11080: HTTP/2 Large Settings Frame DoS (bsc#1181358)

This update was imported from the SUSE:SLE-15:Update update project.

Бписок ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ²

openSUSE Leap 15.2
libnghttp2-14-1.40.0-lp152.2.6.1
libnghttp2-14-32bit-1.40.0-lp152.2.6.1
libnghttp2-devel-1.40.0-lp152.2.6.1
libnghttp2_asio-devel-1.40.0-lp152.2.6.1
libnghttp2_asio1-1.40.0-lp152.2.6.1
libnghttp2_asio1-32bit-1.40.0-lp152.2.6.1
nghttp2-1.40.0-lp152.2.6.1
python3-nghttp2-1.40.0-lp152.2.6.1

Бсылки

ОписаниС

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

Π—Π°Ρ‚Ρ€ΠΎΠ½ΡƒΡ‚Ρ‹Π΅ ΠΏΡ€ΠΎΠ΄ΡƒΠΊΡ‚Ρ‹
openSUSE Leap 15.2:libnghttp2-14-1.40.0-lp152.2.6.1
openSUSE Leap 15.2:libnghttp2-14-32bit-1.40.0-lp152.2.6.1
openSUSE Leap 15.2:libnghttp2-devel-1.40.0-lp152.2.6.1
openSUSE Leap 15.2:libnghttp2_asio-devel-1.40.0-lp152.2.6.1
Бсылки
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡ‚ΡŒ openSUSE-SU-2021:0468-1