drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in mod_http2
Name: |
Ausführen beliebiger Kommandos in mod_http2 |
|
ID: |
FEDORA-2018-63de5f3f6b |
|
Distribution: |
Fedora |
|
Plattformen: |
Fedora 26 |
|
Datum: |
Sa, 28. April 2018, 11:01 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1302 |
|
Applikationen: |
mod_http2 |
|
Originalnachricht |
------------------------------------------------------------------------------- - Fedora Update Notification FEDORA-2018-63de5f3f6b 2018-04-27 22:57:28.389494 ------------------------------------------------------------------------------- -
Name : mod_http2 Product : Fedora 26 Version : 1.10.18 Release : 1.fc26 URL : https://icing.github.io/mod_h2/ Summary : module implementing HTTP/2 for Apache 2 Description : The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.
------------------------------------------------------------------------------- - Update Information:
This release includes the latest stable upstream release of mod_http2. The changes since the last update are: * fixes a race condition where aborting streams triggers an unnecessary timeout. * accurate reporting of h2 data input/output per request via mod_logio. Fixes an issue where output sizes where counted n-times on reused slave connections. See [issue #158](https://github.com/icing/mod_h2/issues/158). * normalized connection prefix logging when trace2 is enabled for direct h2 connection detection. ---- This update includes the latest upstream release of mod_http2, version 1.10.16. This includes a security fix (CVE-2018-1302): When an HTTP/2 stream was destroyed after being handled, mod_http2 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerabilty hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk. ------------------------------------------------------------------------------- - ChangeLog:
* Wed Apr 18 2018 Joe Orton <jorton@redhat.com> - 1.10.18-1 - update to 1.10.18 * Thu Mar 29 2018 Joe Orton <jorton@redhat.com> - 1.10.16-1 - update to 1.10.16 (CVE-2018-1302) * Thu Feb 8 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.13-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild * Tue Nov 7 2017 Joe Orton <jorton@redhat.com> - 1.10.13-1 - update to 1.10.13 * Fri Oct 20 2017 Joe Orton <jorton@redhat.com> - 1.10.12-1 - update to 1.10.12 * Thu Aug 3 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.10-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild * Mon Jul 31 2017 Joe Orton <jorton@redhat.com> - 1.10.10-1 - update to 1.10.10 * Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.7-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild * Thu Jul 6 2017 Joe Orton <jorton@redhat.com> - 1.10.7-1 - update to 1.10.7 ------------------------------------------------------------------------------- - References:
[ 1 ] Bug #1561570 - CVE-2018-1302 mod_http2: httpd: Use-after-free on HTTP/2 stream shutdown [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1561570 [ 2 ] Bug #1560627 - CVE-2018-1302 httpd: Use-after-free on HTTP/2 stream shutdown [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1560627 ------------------------------------------------------------------------------- -
This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-63de5f3f6b' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys ------------------------------------------------------------------------------- - _______________________________________________ package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
|
|
|
|