Summary
USN-7469-1 fixed a vulnerability in Apache Traffic Server. This update
provides the corresponding updates for Node.js.
Original advisory details:
It was discovered that Apache Traffic Server exhibited poor server
resource management in its HTTP/2 protocol. An attacker could possibly
use this issue to cause Apache Traffic Server to crash, resulting in
a denial of service.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | nodejs | 8.10.0~dfsg-2ubuntu0.4+esm6 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | nodejs | 10.19.0~dfsg-3ubuntu1.6+esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | nodejs | 12.22.9~dfsg-1ubuntu3.6+esm2 |
Vulnerabilities 1
-
High 7.5
HTTP/2 Stream Cancellation Attack
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
KEV Oct 10, 2023
References
-
report
https://ubuntu.com/security/CVE-2023-44487