[SECURITY] Fedora 39 Update: rust-h2-0.3.26-1.fc39

An HTTP/2 client and server...

Fedora 39 : rust-h2 (2024-638f25a317)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-638f25a317 advisory. Update to version 0.3.26. Addresses RUSTSEC-2024-0332. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

Fedora 38 : rust-h2 (2024-c5b42e6462)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-c5b42e6462 advisory. Update to version 0.3.26. Addresses RUSTSEC-2024-0332. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

The vulnerability of the h2 library in the Rust programming language in the Tokio environment, related to unlimited resource distribution, allows attackers to cause service failures.

The vulnerability of the h2 library in the Rust programming language in the Tokio environment is related to unlimited resource distribution. Exploiting this vulnerability can allow a remote attacker to cause service failures...

h2 servers vulnerable to degradation of service with CONTINUATION Flood

An attacker can send a flood of CONTINUATION frames, causing h2 to process them indefinitely. This results in an increase in CPU usage. Tokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate requests, albeit with increased latency. Mo...

BeerHolderBot (>=0.1.0 <=0.3.6), GetPDB (>=0.1.0 <=1.0.1) +4593 more potentially affected by unknown CVE via h2 (>=0.1.26 <=0.3.21)

h2 CARGO version =0.1.26, =0.1.0, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.2.0-alpha.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q6CP-QFWQ-4GCV...

GHSA-Q6CP-QFWQ-4GCV h2 servers vulnerable to degradation of service with CONTINUATION Flood

An attacker can send a flood of CONTINUATION frames, causing h2 to process them indefinitely. This results in an increase in CPU usage. Tokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate requests, albeit with increased latency. Mo...

areq (=0.1.0-alpha), bws-web-server (>=0.1.0 <=0.1.1) +26 more potentially affected by unknown CVE via h2 (=0.4.14)

h2 CARGO version =0.4.14 is affected by a known vulnerability. The following packages have a transitive dependency on h2 and may be impacted: - areq =0.1.0-alpha - bws-web-server =0.1.0, =0.5.2, =0.1.0, =1.0.0, =1.5.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.6.0 and more Source cves: unknown CVE Sourc...

RUSTSEC-2024-0332 Degradation of service in h2 servers with CONTINUATION Flood

An attacker can send a flood of CONTINUATION frames, causing h2 to process them indefinitely. This results in an increase in CPU usage. Tokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate requests, albeit with increased latency. Mo...

PT-2024-2636 · Unknown · H2 Library

Name of the Vulnerable Software and Affected Versions: h2 library affected versions not specified Description: The issue is related to unbounded resource allocation in the h2 library of the Rust programming language in a Tokio environment. Exploitation of this issue could allow a remote attacker ...

Com.h2database:h2 vulnerability in the H2 database management system, which allows attackers to perform XXE attacks

The vulnerability of the com.h2database:h2 package in the H2 database management system is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a remote attacker to perform XXE attacks...

Hello, Java 22!

update I've since published a Spring Tips video on this very topic! If you'd prefer, you could watch that instead. Hi, Spring fans! Happy Java 22 release day, to those who celebrate! Did you get the bits already? Go, go, go! Java 22 is a significant improvement that I think is a worthy upgrade fo...

areq (=0.1.0-alpha), bws-web-server (>=0.1.0 <=0.1.1) +26 more potentially affected by unknown CVE via h2 (=0.4.14)

h2 CARGO version =0.4.14 is affected by a known vulnerability. The following packages have a transitive dependency on h2 and may be impacted: - areq =0.1.0-alpha - bws-web-server =0.1.0, =0.5.2, =0.1.0, =1.0.0, =1.5.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.6.0 and more Source cves: unknown CVE Sourc...

BeerHolderBot (>=0.1.0 <=0.3.6), GetPDB (>=0.1.0 <=1.0.1) +4593 more potentially affected by unknown CVE via h2 (>=0.1.26 <=0.3.21)

h2 CARGO version =0.1.26, =0.1.0, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.2.0-alpha.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-8R5V-VM4M-4G25...

areq (=0.1.0-alpha), bws-web-server (>=0.1.0 <=0.1.1) +26 more potentially affected by CVE-2019-9514 via h2 (=0.4.14)

h2 CARGO version =0.4.14 is affected by a known vulnerability. The following packages have a transitive dependency on h2 and may be impacted: - areq =0.1.0-alpha - bws-web-server =0.1.0, =0.5.2, =0.1.0, =1.0.0, =1.5.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.6.0 and more Source cves: CVE-2019-9514...

BeerHolderBot (>=0.1.0 <=0.3.6), GetPDB (>=0.1.0 <=1.0.1) +4593 more potentially affected by CVE-2019-9514 via h2 (>=0.1.26 <=0.3.21)

h2 CARGO version =0.1.26, =0.1.0, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.2.0-alpha.0 and more Source cves: CVE-2019-9514 Source advisory: OSV:RUSTSEC-2024-0003...

RUSTSEC-2024-0003 Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)

An attacker with an HTTP/2 connection to an affected endpoint can send a steady stream of invalid frames to force the generation of reset frames on the victim endpoint. By closing their recv window, the attacker could then force these resets to be queued in an unbounded fashion, resulting in Out ...

Fedora 39 : clevis-pin-tpm2 / greetd / keyring-ima-signer / libkrun / etc (2023-d88521bfc5)

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-d88521bfc5 advisory. Recent updates for the tokio, h2, and openssl crates addressed some potential or confirmed security or soundness issues: - tokio: RUSTSEC-2023-0005 - h2:...

Apache NiFi H2 Connection String Remote Code Execution

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. This exploit will result in several shells 5-7. Successfully test...

Apache NiFi H2 Connection String Remote Code Execution Exploit

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. This exploit will result in several shells 5-7. Successfully test...