Joined: 12 May 2004
|Posted: Mon Dec 05, 2016 3:26 am Post subject: [ GLSA 201612-13 ] nghttp2
|Gentoo Linux Security Advisory
Title: nghttp2: Denial of Service (GLSA 201612-13)
Date: December 05, 2016
Nghttp2 is vulnerable to a Denial of Service attack.
Nghttp2 is an implementation of HTTP/2 and its header compression
algorithm HPACK in C.
Vulnerable: < 1.7.1
Unaffected: >= 1.7.1
Architectures: All supported architectures
Nghttpd, nghttp, and libnghttp2_asio applications do not limit the
memory usage for the incoming HTTP header field. If a peer sends a
specially crafted HTTP/2 HEADERS frame and CONTINUATION frame, they will
crash with an out of memory error.
A remote attacker could possibly cause a Denial of Service condition.
There is no known workaround at this time.
All nghttp2 users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/nghttp2-1.7.1"