Description
The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | oxide-qt | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | firefox | 144.0.2-r0 | — |
References
- 1036741 vdb-entry
- 1036742 vdb-entry
- https://tom.vg/papers/heist_blackhat2016.pdf
- 1036745 vdb-entry
- http://arstechnica.com/security/2016/08/new-attack-steals-ssns-e-mail-addresses-and-more-from-https-pages/
- 1036744 vdb-entry
- 1036743 vdb-entry
- 92773 vdb-entry
- 1036746 vdb-entry