mod_http2-2.0.26-2.el9

エラータID: AXSA:2024-8097:03

Release date: 
Friday, May 31, 2024 - 21:17
Subject: 
mod_http2-2.0.26-2.el9
Affected Channels: 
MIRACLE LINUX 9 for x86_64
Severity: 
Moderate
Description: 

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

* mod_http2: httpd: CONTINUATION frames DoS (CVE-2024-27316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2024-27316
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

Solution: 

Update packages.

CVEs: 
CVE-2024-27316
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
Additional Info: 

N/A

Download: 

SRPMS
  1. mod_http2-2.0.26-2.el9.src.rpm
    MD5: 28864f95304c977b4d152df2d8580dad
    SHA-256: 35c6f8004776f7fbb919e37bdfa4ea00b7c0cc8c8f244524a14d81213fdf9ef4
    Size: 1.01 MB

Asianux Server 9 for x86_64
  1. mod_http2-2.0.26-2.el9.x86_64.rpm
    MD5: 6942d3cf05a42aaa4f5a797bcf65e530
    SHA-256: ba5e37c60782521469d45607ff8e52bc7ecffb40104ff80d07a5e6bf619f79fd
    Size: 162.28 kB