Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_http2 | 0:2.0.26-1.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_http2-debuginfo | 0:2.0.26-1.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_http2-debugsource | 0:2.0.26-1.el9 |
Vulnerabilities 2
-
Unscored —
Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" a…
-
Unscored —CVE-2023-45802 Public exploit
Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping t…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2243877
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2245153
-
article
https://issues.redhat.com/browse/RHEL-14691
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2368.json
-
report
https://access.redhat.com/security/cve/CVE-2023-43622
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-43622
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-43622
-
article
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2023-43622
-
report
https://access.redhat.com/security/cve/CVE-2023-45802
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-45802
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-45802
-
article
https://httpd.apache.org/security/vulnerabilities_24.html