Hi, On Sat, Oct 12, 2024 at 11:37:29AM +0200, Moritz Mühlenhoff wrote: > Source: h2o > X-Debbugs-CC: [email protected] > Severity: important > Tags: security > > Hi, > > The following vulnerabilities were published for h2o. > > CVE-2024-45403[0]: > | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. > | When h2o is configured as a reverse proxy and HTTP/3 requests are > | cancelled by the client, h2o might crash due to an assertion > | failure. The crash can be exploited by an attacker to mount a > | Denial-of-Service attack. By default, the h2o standalone server > | automatically restarts, minimizing the impact. However, HTTP > | requests that were served concurrently will still be disrupted. The > | vulnerability has been addressed in commit 1ed32b2. Users may > | disable the use of HTTP/3 to mitigate the issue. > > https://github.com/h2o/h2o/security/advisories/GHSA-4xp5-3jhc-3m92 > https://github.com/h2o/h2o/commit/16b13eee8ad7895b4fe3fcbcabee53bd52782562 > https://github.com/h2o/h2o/commit/1ed32b23f999acf0c5029f09c8525f93eb1d354c
TTBOMK, this does not apply to the versions in Debian as the has been introduced later. I have retitle the bug, but please correct me if I'm wrong with my assessment. Regards, Salvatore
