VuXML ID | Description |
73b1e734-c74e-11e9-8052-0028f8d09152 | h2o -- multiple HTTP/2 vulnerabilities
Jonathon Loomey of Netflix reports:
HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion
Recently, a series of DoS attack vulnerabilities have been reported on a broad range of HTTP/2 stacks. Among the vulnerabilities, H2O is exposed to the following:
- CVE-2019-9512 "Ping Flood": The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.
- CVE-2019-9514 "Reset Flood": The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service.
- CVE-2019-9515 "Settings Flood": The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.
Discovery 2019-08-13 Entry 2019-08-25 h2o
< 2.2.6
https://github.com/h2o/h2o/issues/2090
https://www.kb.cert.org/vuls/id/605641/
CVE-2019-9512
CVE-2019-9514
CVE-2019-9515
|
ce39379f-7eb7-11e8-ab03-00bd7f19ff09 | h2o -- heap buffer overflow during logging
Marlies Ruck reports:
Fix heap buffer overflow while trying to emit access log
- see references for full details.
CVE-2018-0608: Buffer overflow in H2O version 2.2.4 and
earlier allows remote attackers to execute arbitrary code or
cause a denial of service (DoS) via unspecified vectors.
Discovery 2018-06-01 Entry 2018-07-03 h2o
< 2.2.5
CVE-2018-0608
https://github.com/h2o/h2o/issues/1775
https://github.com/h2o/h2o/releases/tag/v2.2.5
|
6c808811-bb9a-11e5-a65c-485d605f4717 | h2o -- directory traversal vulnerability
Yakuzo OKU reports:
When redirect directive is used, this flaw allows a remote
attacker to inject response headers into an HTTP redirect response.
Discovery 2016-01-13 Entry 2016-01-15 h2o
< 1.6.2
CVE-2016-1133
https://h2o.examp1e.net/vulnerabilities.html
|
10c0fabc-b5da-11e7-816e-00bd5d1fff09 | h2o -- DoS in workers
Frederik Deweerdt reports:
Multiple Denial-of-Service vulnerabilities exist in h2o workers -
see references for full details.
CVE-2017-10868: Worker processes may crash when receiving a request with invalid framing.
CVE-2017-10869: The stack may overflow when proxying huge requests.
Discovery 2017-07-19 Entry 2017-10-17 h2o
< 2.2.3
CVE-2017-10868
CVE-2017-10869
https://github.com/h2o/h2o/issues/1459
https://github.com/h2o/h2o/issues/1460
https://github.com/h2o/h2o/releases/tag/v2.2.3
|
31ea7f73-5c55-11e5-8607-74d02b9a84d5 | h2o -- directory traversal vulnerability
Yakuzo reports:
H2O (up to version 1.4.4 / 1.5.0-beta1) contains a flaw in its URL
normalization logic.
When file.dir directive is used, this flaw
allows a remote attacker to retrieve arbitrary files that exist
outside the directory specified by the directive.
H2O version 1.4.5 and version 1.5.0-beta2 have been released
to address this vulnerability.
Users are advised to upgrade their servers immediately.
The vulnerability was reported by: Yusuke OSUMI.
Discovery 2015-09-14 Entry 2015-09-16 h2o
< 1.4.5
CVE-2015-5638
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5638
|
d0b12952-cb86-11e6-906f-0cc47a065786 | h2o -- Use-after-free vulnerability
Kazuho Oku reports:
A use-after-free vulnerability exists in H2O up to and including
version 2.0.4 / 2.1.0-beta3 that can be used by a remote attacker to
mount DoS attacks and / or information theft.
Discovery 2016-09-09 Entry 2016-12-29 h2o
< 2.0.4_2
https://github.com/h2o/h2o/releases/tag/v2.0.5
https://github.com/h2o/h2o/issues/1144
|
65bb1858-27de-11e6-b714-74d02b9a84d5 | h2o -- use after free on premature connection close
Tim Newsha reports:
When H2O tries to disconnect a premature HTTP/2 connection, it
calls free(3) to release memory allocated for the connection and
immediately after then touches the memory. No malloc-related
operation is performed by the same thread between the time it calls
free and the time the memory is touched. Fixed by Frederik
Deweerdt.
Discovery 2016-05-17 Entry 2016-06-01 h2o
< 1.7.3
https://h2o.examp1e.net/vulnerabilities.html
|
08664d42-7989-11e6-b7a8-74d02b9a84d5 | h2o -- fix DoS attack vector
Frederik Deweerdt reported a denial-of-service attack vector
due to an unhandled error condition during socket connection.
Discovery 2016-06-09 Entry 2016-09-14 h2o
< 2.0.4
https://github.com/h2o/h2o/issues/1077
CVE-2016-4864
|