FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  556424
Date:      2020-11-27
Time:      00:34:50Z
Committer: brd

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
6c808811-bb9a-11e5-a65c-485d605f4717h2o -- directory traversal vulnerability

Yakuzo OKU reports:

When redirect directive is used, this flaw allows a remote attacker to inject response headers into an HTTP redirect response.

Discovery 2016-01-13
Entry 2016-01-15
lt 1.6.2

d0b12952-cb86-11e6-906f-0cc47a065786h2o -- Use-after-free vulnerability

Kazuho Oku reports:

A use-after-free vulnerability exists in H2O up to and including version 2.0.4 / 2.1.0-beta3 that can be used by a remote attacker to mount DoS attacks and / or information theft.

Discovery 2016-09-09
Entry 2016-12-29
lt 2.0.4_2
31ea7f73-5c55-11e5-8607-74d02b9a84d5h2o -- directory traversal vulnerability

Yakuzo reports:

H2O (up to version 1.4.4 / 1.5.0-beta1) contains a flaw in its URL normalization logic.

When file.dir directive is used, this flaw allows a remote attacker to retrieve arbitrary files that exist outside the directory specified by the directive.

H2O version 1.4.5 and version 1.5.0-beta2 have been released to address this vulnerability.

Users are advised to upgrade their servers immediately.

The vulnerability was reported by: Yusuke OSUMI.

Discovery 2015-09-14
Entry 2015-09-16
lt 1.4.5

65bb1858-27de-11e6-b714-74d02b9a84d5h2o -- use after free on premature connection close

Tim Newsha reports:

When H2O tries to disconnect a premature HTTP/2 connection, it calls free(3) to release memory allocated for the connection and immediately after then touches the memory. No malloc-related operation is performed by the same thread between the time it calls free and the time the memory is touched. Fixed by Frederik Deweerdt.

Discovery 2016-05-17
Entry 2016-06-01
lt 1.7.3
ce39379f-7eb7-11e8-ab03-00bd7f19ff09h2o -- heap buffer overflow during logging

Marlies Ruck reports:

Fix heap buffer overflow while trying to emit access log - see references for full details.

CVE-2018-0608: Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unspecified vectors.

Discovery 2018-06-01
Entry 2018-07-03
lt 2.2.5

73b1e734-c74e-11e9-8052-0028f8d09152h2o -- multiple HTTP/2 vulnerabilities

Jonathon Loomey of Netflix reports:

HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion

Recently, a series of DoS attack vulnerabilities have been reported on a broad range of HTTP/2 stacks. Among the vulnerabilities, H2O is exposed to the following:

  • CVE-2019-9512 "Ping Flood": The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.
  • CVE-2019-9514 "Reset Flood": The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service.
  • CVE-2019-9515 "Settings Flood": The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.

Discovery 2019-08-13
Entry 2019-08-25
lt 2.2.6
08664d42-7989-11e6-b7a8-74d02b9a84d5h2o -- fix DoS attack vector

Frederik Deweerdt reported a denial-of-service attack vector due to an unhandled error condition during socket connection.

Discovery 2016-06-09
Entry 2016-09-14
lt 2.0.4
10c0fabc-b5da-11e7-816e-00bd5d1fff09h2o -- DoS in workers

Frederik Deweerdt reports:

Multiple Denial-of-Service vulnerabilities exist in h2o workers - see references for full details.

CVE-2017-10868: Worker processes may crash when receiving a request with invalid framing.

CVE-2017-10869: The stack may overflow when proxying huge requests.

Discovery 2017-07-19
Entry 2017-10-17
lt 2.2.3