Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2016-8740 →
DEBIAN-CVE-2016-8740
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-h...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
apache2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.25-1"}]}]
Debian:13
apache2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.25-1"}]}]
Debian:14
apache2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.25-1"}]}]
Références
- advisory security-tracker.debian.org