diff options
| author | Yogita Urade <yogita.urade@windriver.com> | 2023-08-25 08:45:26 +0000 |
|---|---|---|
| committer | Steve Sakoman <steve@sakoman.com> | 2023-08-30 04:46:36 -1000 |
| commit | 1cae56f2168095927b6deafef9328a07f061c096 (patch) | |
| tree | 41309bb999a549c3eb728dc2f857af502a0e58ac /scripts/lib/devtool/sdk.py | |
| parent | 074ad15e1e34007997e58892daf759c8d6d9abff (diff) | |
| download | poky-1cae56f2168095927b6deafef9328a07f061c096.tar.gz | |
nghttp2: fix CVE-2023-35945
Envoy is a cloud-native high-performance edge/middle/service
proxy. Envoy’s HTTP/2 codec may leak a header map and
bookkeeping structures upon receiving `RST_STREAM` immediately
followed by the `GOAWAY` frames from an upstream server. In
nghttp2, cleanup of pending requests due to receipt of the
`GOAWAY` frame skips de-allocation of the bookkeeping structure
and pending compressed header. The error return [code path] is
taken if connection is already marked for not sending more
requests due to `GOAWAY` frame. The clean-up code is right after
the return statement, causing memory leak. Denial of service
through memory exhaustion. This vulnerability was patched in
versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-35945
https://github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r
(From OE-Core rev: 0e6eb0f417079eaf76b003973c9d93338e6363b5)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'scripts/lib/devtool/sdk.py')
0 files changed, 0 insertions, 0 deletions