EulerOS 2.0 SP9 : golang (EulerOS-SA-2022-1428)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header falsely designating that many files are present can cause ...

httpd:2.4 security update

2.4.37-43.0.3.3 - Resolves: CVE-2021-33193 a crafted method sent through HTTP/2 will bypass validation Orabug: 33942809...

lwan:h2_huffman_fuzzer: Heap-buffer-overflow in lwan_h2_huffman_decode_for_fuzzing

Project: git://github.com/lpereira/lwan https://github.com/lpereira/lwan.git Detailed Report: https://oss-fuzz.com/testcase?key=4703583657918464 Project: lwan Fuzzing Engine: libFuzzer Fuzz Target: h2huffmanfuzzer Job Type: libfuzzerasanlwan Platform Id: linux Crash Type: Heap-buffer-overflow REA...

CVE-2022-1259

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server...

Ubuntu 18.04 LTS / 20.04 LTS : Tomcat vulnerabilities (USN-5360-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5360-1 advisory. It was discovered that Tomcat incorrectly performed input verification. A remote attacker could possibly use this issue to intercept sensitiv...

Ubuntu: Security Advisory (USN-5313-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5313-2: OpenJDK 11 regression

USN-5313-1 fixed vulnerabilities and added features in OpenJDK. Unfortunately, that update introduced a regression in OpenJDK 11 that could impact interoperability with some popular HTTP/2 servers making it unable to connect to said servers. This update fixes the problem. We apologize for the...

EulerOS 2.0 SP8 : golang (EulerOS-SA-2022-1345)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2...

Security Bulletin: Vulnerabilities in Node.js affect IBM Spectrum Control (CVE-2020-8172, CVE-2020-8174, CVE-2020-11080)

Summary Node.js is vulnerable to a denial of service or could allow a remote attacker to bypass security restrictions. These vulnerabilities may affect IBM Spectrum Control. Vulnerability Details CVEID: CVE-2020-8172 DESCRIPTION: Node.js could allow a remote attacker to bypass security...

java-11-openjdk bug fix and enhancement update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Bug Fixes: The previous OpenJDK 11 release, 11.0.14, was found to contain a regression introduced by improvements to the HTTP client. It caused both the :authority' and...

PT-2022-1017

Name of the Vulnerable Software and Affected Versions java-11-openjdk versions 11.0.14 Description The issue concerns a regression in the HTTP client of OpenJDK 11, which caused both the :authority and Host header fields to be sent in HTTP/2 requests. This behavior is rejected by some HTTP server...

GHSA-32GV-6CF3-WCMQ HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods

Impact Twisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities: Ping flood: https://vulners.com/cve/CVE-2019-9512 Reset flood: https://vulners.com/cve/CVE-2019-9514 Settings flood: https://vulners.com/cve/CVE-2019-9515 A Twisted...

HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods

Impact Twisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities: Ping flood: https://vulners.com/cve/CVE-2019-9512 Reset flood: https://vulners.com/cve/CVE-2019-9514 Settings flood: https://vulners.com/cve/CVE-2019-9515 A Twisted...

Denial Of Service (DoS)

github.com/apple/swift-nio-http2 is vulnerable to denial of service. A remote attacker can cause a logical error when parsing HTTP/2 HEADERS or HTTP/2 PUSHPROMISE frames, causing the entire process to crash, resulting in a denial of service conditions...

CVE-2022-0618

A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS or HTTP/2 PUSHPROMISE frame where the frame contains padding information...

Design/Logic Flaw

A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS or HTTP/2 PUSHPROMISE frame where the frame contains padding information...

CVE-2022-0618

A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS or HTTP/2 PUSHPROMISE frame where the frame contains padding information...

CVE-2022-0618

CVE-2022-0618 affects the swift-nio-http2 project. A logical error in parsing HTTP/2 HEADERS and PUSH_PROMISE frames containing only padding information can cause a parsing failure, crashing the process and harming availability. The issue affects swift-nio-http2 versions 1.0.0 through 1.19.2 and ...

CVE-2022-0618

A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS or HTTP/2 PUSHPROMISE frame where the frame contains padding information...

CVE-2022-0618: Improper Handling of Length Parameter Inconsistency

A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS or HTTP/2 PUSHPROMISE frame where the frame contains padding information...