Slackware alert SSA:2024-095-02 (nghttp2)
| From: | Slackware Security Team <security@slackware.com> | |
| To: | slackware-security@slackware.com | |
| Subject: | [slackware-security] nghttp2 (SSA:2024-095-02) | |
| Date: | Thu, 04 Apr 2024 12:17:04 -0700 | |
| Message-ID: | <alpine.LNX.2.02.2404041216490.31322@connie.slackware.com> |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] nghttp2 (SSA:2024-095-02) New nghttp2 packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: +--------------------------+ patches/packages/nghttp2-1.61.0-i586-1_slack15.0.txz: Upgraded. This update fixes security issues: nghttp2 library keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it can accept after a HEADERS frame. For more information, see: https://github.com/nghttp2/nghttp2/security/advisories/GH... https://www.kb.cert.org/vuls/id/421644 https://www.cve.org/CVERecord?id=CVE-2024-28182 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 15.0: ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patc... Updated package for Slackware x86_64 15.0: ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/pa... Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/s... Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current... MD5 signatures: +-------------+ Slackware 15.0 package: ec7c0c10fbd8fc955172c165ac83e820 nghttp2-1.61.0-i586-1_slack15.0.txz Slackware x86_64 15.0 package: 83b16e89f34a2b3ab340c4e8be7e013b nghttp2-1.61.0-x86_64-1_slack15.0.txz Slackware -current package: 1344e95b1100f186ed42012881ca29c9 n/nghttp2-1.61.0-i586-1.txz Slackware x86_64 -current package: 03b5154892afcc2f9bfcaee440229252 n/nghttp2-1.61.0-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg nghttp2-1.61.0-i586-1_slack15.0.txz +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com +------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. | +------------------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQTsVknaQB4iq/pnNu9qRGPAQBAiMwUCZg77GAAKCRBqRGPAQBAi MxZhAJ9ul/4pGOrgtdZAzPm/JqlTakTCqACeKs6rDUIuIj3KjeJ7R3wDvJUYKvU= =nbE8 -----END PGP SIGNATURE-----