PT-2021-5821

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 12.22.4 Node.js versions prior to 14.17.4 Node.js versions prior to 16.6.0 Description The issue is related to a use after free attack in Node.js, where an attacker might exploit memory corruption to change process...

netty: Request smuggling via content-length header

A flaw was found in Netty. There is an issue where the content-length header is not validated correctly if the request uses a single Http2HeaderFrame with the endstream set to true. This flaw leads to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. The...

Node.js -- July 2021 Security Releases (2)

Node.js reports: Use after free on close http2 on stream canceling High CVE-2021-22930 Node.js is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior...

netty: Request smuggling via content-length header

A flaw was found in Netty. There is an issue where the content-length header is not validated correctly if the request uses a single Http2HeaderFrame with the endstream set to true. This flaw leads to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. The...

CVE-2021-36154

HTTP2ToRawGRPCServerCodec in gRPC Swift 1.1.1 and earlier allows remote attackers to deny service via the delivery of many small messages within a single HTTP/2 frame, leading to Uncontrolled Recursion and stack consumption...

gRPC Swift input validation error vulnerability

gRPC Swift is an open source Swift language implementation of gRPC , it contains a gRPC Swift API and code generator . Provides an API and generated code for gRPC clients and servers and can be built using Xcode or the Swift package manager. A security vulnerability in HTTP2ToRawGRPCServerCodec i...

gRPC Swift security vulnerabilities

gRPC Swift is an open source Swift language implementation of gRPC , it contains a gRPC Swift API and code generator . The API and generated code are provided for gRPC clients and servers and can be built using Xcode or the Swift package manager. A security vulnerability exists in gRPC Swift 1.1....

Apache Traffic Server Input Validation Error Vulnerability

Apache Traffic Server or ATS or TS for short , is a high-performance , modular HTTP proxy and caching server . An improper input validation vulnerability exists in HTTP/2 in Apache Traffic Server versions 7.0.0 - 7.1.12, 8.0.0 - 8.1.1, 9.0.0 - 9.0.1. An attacker could exploit this vulnerability t...

DEBIAN-CVE-2021-32567

Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1...

[SECURITY] Fedora 34 Update: mod_http2-1.15.19-1.fc34

The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers...

[SECURITY] Fedora 33 Update: mod_http2-1.15.19-1.fc33

The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers...

Fedora: Security Advisory for mod_http2 (FEDORA-2021-181f29c392)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for mod_http2 (FEDORA-2021-051639aad4)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

io.undertow:undertow-http2-test-suite (1.3.0.beta12), io.undertow:undertow-servlet (1.3.0.beta12) +1 more potentially affected by CVE-2021-20220 via io.undertow:undertow-core (1.3.0.beta12)

io.undertow:undertow-core MAVEN version 1.3.0.beta12 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.beta12 - io.undertow:undertow-servlet 1.3.0.beta12 -...

io.undertow:undertow-http2-test-suite (1.3.0.beta3), io.undertow:undertow-servlet (1.3.0.beta3) +32 more potentially affected by CVE-2021-20220 via io.undertow:undertow-core (1.3.0.beta3)

io.undertow:undertow-core MAVEN version 1.3.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.beta3 - io.undertow:undertow-servlet 1.3.0.beta3 -...

io.undertow:undertow-http2-test-suite (1.2.3.final), io.undertow:undertow-servlet (1.2.3.final) +2 more potentially affected by CVE-2021-20220 via io.undertow:undertow-core (1.2.3.final)

io.undertow:undertow-core MAVEN version 1.2.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.3.final - io.undertow:undertow-servlet 1.2.3.final -...

io.undertow:undertow-http2-test-suite (1.3.13.final), io.undertow:undertow-servlet (1.3.13.final) +1 more potentially affected by CVE-2021-20220 via io.undertow:undertow-core (1.3.13.final)

io.undertow:undertow-core MAVEN version 1.3.13.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.13.final - io.undertow:undertow-servlet 1.3.13.final -...

io.undertow:undertow-http2-test-suite (1.1.0.beta8), io.undertow:undertow-servlet (1.1.0.beta8) +1 more potentially affected by CVE-2021-20220 via io.undertow:undertow-core (1.1.0.beta8)

io.undertow:undertow-core MAVEN version 1.1.0.beta8 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.1.0.beta8 - io.undertow:undertow-servlet 1.1.0.beta8 -...

io.undertow:undertow-http2-test-suite (1.3.1.final), io.undertow:undertow-servlet (1.3.1.final) +1 more potentially affected by CVE-2021-20220 via io.undertow:undertow-core (1.3.1.final)

io.undertow:undertow-core MAVEN version 1.3.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.1.final - io.undertow:undertow-servlet 1.3.1.final -...

io.undertow:undertow-http2-test-suite (1.2.1.final), io.undertow:undertow-servlet (1.2.1.final) +1 more potentially affected by CVE-2021-20220 via io.undertow:undertow-core (1.2.1.final)

io.undertow:undertow-core MAVEN version 1.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.1.final - io.undertow:undertow-servlet 1.2.1.final -...