Moderate: mod_http2 security update
Summary
ALSA-2024:2368: Moderate: mod_http2 security update. Affects mod_http2 versions < 2.0.26-1.el9. Fixed in 2.0.26-1.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The mod_http2 Apache httpd module is responsible for implementing the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. This module allows for enhanced performance and efficiency in handling HTTP requests and responses. However, it has been discovered that mod_http2 is susceptible to certain security vulnerabilities.
Vulnerability Detail
The mod_http2 module is affected by two security issues:
-
CVE-2023-43622: This vulnerability allows for a Denial of Service (DoS) attack in HTTP/2 when the initial window size is set to 0. An attacker can exploit this flaw to exhaust server resources and disrupt the normal functioning of the server.
-
CVE-2023-45802: This vulnerability relates to an incomplete fix for a previous vulnerability (CVE-2023-44487). It allows an attacker to reset requests, leading to memory exhaustion on the server.
These vulnerabilities can have serious consequences, including service disruption, resource exhaustion, and potential unauthorized access to sensitive information.
How To Fix
Minimum fixed version
2.0.26-1.el9
This is the first release that contains the fix.
sudo dnf update mod_http2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the mod_http2 Apache httpd module is affected by two security vulnerabilities that can lead to service disruption, resource exhaustion, and potential unauthorized access. It is highly recommended to update the mod_http2 package to version 2.0.26-1.el9 or later to mitigate these risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for mod_http2 →
FAQ
These vulnerabilities can lead to service disruption, resource exhaustion, and potential unauthorized access to sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file and the tool will provide real-time alerts for any open-source vulnerabilities.
At the moment, there are no known workarounds for these vulnerabilities. It is recommended to apply the provided security update to mitigate the risks.
Yes, these vulnerabilities can be exploited remotely by sending specially crafted requests to the affected server.
There is no evidence of active exploitation of these vulnerabilities at the moment. However, it is crucial to apply the security update as a proactive measure.
Related vulnerabilities
Recent vulnerabilities recorded for mod_http2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
