Bug#847124: apache2: CVE-2016-8740: erver memory can be exhausted and service denied when HTTP/2 is used

2016-12-05 Thread Salvatore Bonaccorso 
Source: apache2
Version: 2.4.23-8
Severity: important
Tags: security upstream patch

Hi

CVE-2016-8740 was announced for apache, CVE-2016-8740, Server memory
can be exhausted and service denied when HTTP/2 is used.

Post to oss-security at:
http://www.openwall.com/lists/oss-security/2016/12/05/14

Patch: https://svn.apache.org/r1772576

Regards,
Salvatore

Bug#847124: apache2: CVE-2016-8740: erver memory can be exhausted and service denied when HTTP/2 is used

2016-12-11 Thread Stefan Fritsch 
On Monday, 5 December 2016 21:13:04 CET Salvatore Bonaccorso wrote:
> CVE-2016-8740 was announced for apache, CVE-2016-8740, Server memory
> can be exhausted and service denied when HTTP/2 is used.

There are a few more security issues fixed in the pending 2.4.24 release. I 
will wait a bit more in the hope that this is released soonish.

Stefan