[SECURITY] [DLA 3638-1] h2o security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3638-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Anton Gladky
October 29, 2023 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : h2o
Version : 2.2.5+dfsg2-2+deb10u2
CVE ID : CVE-2023-44487
Debian Bug : 1054232
A vulnerability has been identified in h2o, a high-performance web server
with support for HTTP/2.
A security vulnerability CVE-2023-44487 was discovered that could potentially
be exploited to disrupt server operation.
The vulnerability in the h2o HTTP/2 server was related to the handling of
certain types of HTTP/2 requests. In certain scenarios, an attacker could
send a series of malicious requests, causing the server to process them
rapidly and exhaust system resources.
The applied upstream patch changes the ABI. Therefore, if your application
is built against any shared libraries of h2o, you need to rebuild it.
No Debian package is affected.
For Debian 10 buster, this problem has been fixed in version
2.2.5+dfsg2-2+deb10u2.
We recommend that you upgrade your h2o packages.
For the detailed security status of h2o please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/h2o
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEu71F6oGKuG/2fnKF0+Fzg8+n/wYFAmVBCo8ACgkQ0+Fzg8+n
/wbanQ//Yo0J2I6ph/5a2hZfQ+kgbsMBXCy7hZh6CenGPgHTjCWPp48ss7Pje0ZB
j6w6EdMMpqgGHkS3ODMoavcK1Kvh+9ARtpS8yHvLuQo60IF8juaeJXQvSYZm9Lvk
4E7EiMOZ3MU+zPht9DgDi6CdeT9TS0aMRqWT89ClRJ63PUFJvIojby6wSKZ5jXg5
REoD1tAwNw+TMpQuH5NFCkn/SwhzPxwV/gzLSgwqynkXOBoVk1oLQ0e0utyla3tg
RUl1x3b6LGm3mzpsufCSJ6e4nLoj7VWz0w1/U+RPYB+Sp4ORailC1LwF9GwjEuhq
o+CETCwUsO4WtyR5QtSFTWYDBF65j9X+OfOSsuC5POykBM/KmXyRsZHzeETp30/c
vbciK9xFP5b5iNk1aEfLxL2QJVcENFAfBzfIizggKWSFVVoJiSDQVbN3dY4QoQ8P
yXX2CFgQmmv0TtSp7j7Lq1/oAxIiIp4RQWjqA18T3w1muuQ20fNJnEgNAs0Lh69v
eiM6qbP5w9WMC0BUjPSqmg693A+SPk5nxcq1BX1uvQmF1UGlKCGX8E7iX8YAthjg
KfWHS9KEUuW4AyoHCnJFtRqSEumScOaPfzNcfYMn/aCPCZ/TL/Qa1Mft26hpBn66
j7C637FYQ4gLCQMRykeHo45ES4jaZZO6XuotgUgDybgdzsv0vjc=
=0auQ
-----END PGP SIGNATURE-----
Reply to: