FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-05-01 20:12:40 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
4da51989-5a8b-4eb9-b442-46d94ec0802d	h2o -- Malformed HTTP/1.1 causes Out-of-Memory Denial of Service Elijah Glover reports: Malformed HTTP/1.1 requests can crash worker processes. occasionally locking up child workers and causing denial of service, and an outage dropping any open connections. Discovery 2023-04-27 Entry 2023-04-30 h2o le 2.2.6 h2o-devel < 2.3.0.d.20230427 CVE-2023-30847 https://github.com/h2o/h2o/security/advisories/GHSA-p5hj-phwj-hrvx
bf545001-b96d-42e4-9d2e-60fdee204a43	h2o -- HTTP/2 Rapid Reset attack vulnerability Kazuo Okuhu reports: H2O is vulnerable to the HTTP/2 Rapid Reset attack. An attacker might be able to consume more than adequate amount of processing power of h2o and the backend servers by mounting the attack. Discovery 2023-10-10 Entry 2023-10-10 h2o le 2.2.6 h2o-devel < 2.3.0.d.20231010 CVE-2023-44487 https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf
1d3677a8-9143-42d8-84a3-0585644dff4b	h2o -- uninitialised memory access in HTTP3 Emil Lerner reports: When receiving QUIC frames in certain order, HTTP/3 server-side implementation of h2o can be misguided to treat uninitialized memory as HTTP/3 frames that have been received. When h2o is used as a reverse proxy, an attacker can abuse this vulnerability to send internal state of h2o to backend servers controlled by the attacker or third party. Also, if there is an HTTP endpoint that reflects the traffic sent from the client, an attacker can use that reflector to obtain internal state of h2o. This internal state includes traffic of other connections in unencrypted form and TLS session tickets. This vulnerability exists in h2o server with HTTP/3 support, between commit 93af138 and d1f0f65. None of the released versions of h2o are affected by this vulnerability. Discovery 2021-01-31 Entry 2022-02-02 h2o-devel < 2.3.0.d.20220131 CVE-2021-43848 https://github.com/h2o/h2o/security/advisories/GHSA-f9xw-j925-m4m4

VuXML ID

Description

4da51989-5a8b-4eb9-b442-46d94ec0802d

h2o -- Malformed HTTP/1.1 causes Out-of-Memory Denial of Service

Elijah Glover reports:

Malformed HTTP/1.1 requests can crash worker processes. occasionally locking up child workers and causing denial of service, and an outage dropping any open connections.

Discovery 2023-04-27
Entry 2023-04-30
h2o

le 2.2.6

h2o-devel

< 2.3.0.d.20230427

CVE-2023-30847
https://github.com/h2o/h2o/security/advisories/GHSA-p5hj-phwj-hrvx

bf545001-b96d-42e4-9d2e-60fdee204a43

h2o -- HTTP/2 Rapid Reset attack vulnerability

Kazuo Okuhu reports:

H2O is vulnerable to the HTTP/2 Rapid Reset attack. An attacker might be able to consume more than adequate amount of processing power of h2o and the backend servers by mounting the attack.

Discovery 2023-10-10
Entry 2023-10-10
h2o

le 2.2.6

h2o-devel

< 2.3.0.d.20231010

CVE-2023-44487
https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf

1d3677a8-9143-42d8-84a3-0585644dff4b

h2o -- uninitialised memory access in HTTP3

Emil Lerner reports:

When receiving QUIC frames in certain order, HTTP/3 server-side implementation of h2o can be misguided to treat uninitialized memory as HTTP/3 frames that have been received. When h2o is used as a reverse proxy, an attacker can abuse this vulnerability to send internal state of h2o to backend servers controlled by the attacker or third party. Also, if there is an HTTP endpoint that reflects the traffic sent from the client, an attacker can use that reflector to obtain internal state of h2o.

This internal state includes traffic of other connections in unencrypted form and TLS session tickets.

This vulnerability exists in h2o server with HTTP/3 support, between commit 93af138 and d1f0f65. None of the released versions of h2o are affected by this vulnerability.

Discovery 2021-01-31
Entry 2022-02-02
h2o-devel

< 2.3.0.d.20220131

CVE-2021-43848
https://github.com/h2o/h2o/security/advisories/GHSA-f9xw-j925-m4m4