nghttp2: CVE-2024-28182: Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

Debian Bug report logs - #1068415
nghttp2: CVE-2024-28182: Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: nghttp2: CVE-2024-28182: Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

Date: Thu, 04 Apr 2024 21:36:32 +0200

Source: nghttp2
Version: 1.60.0-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for nghttp2.

CVE-2024-28182[0]:
| nghttp2 is an implementation of the Hypertext Transfer Protocol
| version 2 in C. The nghttp2 library prior to version 1.61.0 keeps
| reading the unbounded number of HTTP/2 CONTINUATION frames even
| after a stream is reset to keep HPACK context in sync.  This causes
| excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0
| mitigates this vulnerability by limiting the number of CONTINUATION
| frames it accepts per stream. There is no workaround for this
| vulnerability.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-28182
    https://www.cve.org/CVERecord?id=CVE-2024-28182
[1] https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 1068415@bugs.debian.org (full text, mbox, reply):

From: Tomasz Buchert <tomasz@buchert.pl>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 1068415@bugs.debian.org

Subject: Re: nghttp2: CVE-2024-28182: Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

Date: Fri, 5 Apr 2024 01:11:41 +0200

On 04/04/24 21:36, Salvatore Bonaccorso wrote:
> Source: nghttp2
> Version: 1.60.0-1
> Severity: grave
> Tags: security upstream
> Justification: user security hole
> X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
> 
> Hi,
> 
> The following vulnerability was published for nghttp2.
> 
> CVE-2024-28182[0]:
> | nghttp2 is an implementation of the Hypertext Transfer Protocol
> | version 2 in C. The nghttp2 library prior to version 1.61.0 keeps
> | reading the unbounded number of HTTP/2 CONTINUATION frames even
> | after a stream is reset to keep HPACK context in sync.  This causes
> | excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0
> | mitigates this vulnerability by limiting the number of CONTINUATION
> | frames it accepts per stream. There is no workaround for this
> | vulnerability.
> 
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2024-28182
>     https://www.cve.org/CVERecord?id=CVE-2024-28182
> [1] https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q
> 
> Please adjust the affected versions in the BTS as needed.
> 
> Regards,
> Salvatore

As the first measure I uploaded 1.61.0-1 to unstable with urgency=high.

Looking into older versions and appropriately patching them will take more time.

Tomasz

Send a report that this bug log contains spam.