Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
6fb4d47e by Moritz Muehlenhoff at 2019-08-16T07:45:39Z
track h2o, ATS for HTTP2 issues
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -17018,8 +17018,12 @@ CVE-2019-9515 (Some HTTP/2 implementations are
vulnerable to a settings flood, p
- nodejs <unfixed>
[stretch] - nodejs <not-affected> (No HTTP2 support yet)
[jessie] - nodejs <not-affected> (No HTTP2 support yet)
+ - trafficserver <unfixed>
+ - h2o <unfixed>
NOTE:
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
NOTE:
https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
+ NOTE:
https://raw.githubusercontent.com/apache/trafficserver/8.0.x/CHANGELOG-8.0.4
+ NOTE: https://github.com/h2o/h2o/issues/2090
CVE-2019-9514 (Some HTTP/2 implementations are vulnerable to a reset flood,
potential ...)
- golang-1.13 <unfixed>
- golang-1.12 1.12.8-1
@@ -17031,11 +17035,15 @@ CVE-2019-9514 (Some HTTP/2 implementations are
vulnerable to a reset flood, pote
- nodejs <unfixed>
[stretch] - nodejs <not-affected> (No HTTP2 support yet)
[jessie] - nodejs <not-affected> (No HTTP2 support yet)
+ - trafficserver <unfixed>
+ - h2o <unfixed>
NOTE: Issue: https://github.com/golang/go/issues/33606
NOTE:
https://github.com/golang/go/commit/e152b01a468a1c18a290bf9aec52ccea7693c7f2
(golang-1.11)
NOTE:
https://github.com/golang/go/commit/7139b45d1410ded14e1e131151fd8dfc435ede6c
(golang-1.12)
NOTE:
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
NOTE:
https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
+ NOTE:
https://raw.githubusercontent.com/apache/trafficserver/8.0.x/CHANGELOG-8.0.4
+ NOTE: https://github.com/h2o/h2o/issues/2090
CVE-2019-9513 (Some HTTP/2 implementations are vulnerable to resource loops,
potentia ...)
- nginx <unfixed>
- nodejs <unfixed>
@@ -17055,11 +17063,15 @@ CVE-2019-9512 (Some HTTP/2 implementations are
vulnerable to ping floods, potent
- nodejs <unfixed>
[stretch] - nodejs <not-affected> (No HTTP2 support yet)
[jessie] - nodejs <not-affected> (No HTTP2 support yet)
+ - trafficserver <unfixed>
+ - h2o <unfixed>
NOTE: Issue: https://github.com/golang/go/issues/33606
NOTE:
https://github.com/golang/go/commit/e152b01a468a1c18a290bf9aec52ccea7693c7f2
(golang-1.11)
NOTE:
https://github.com/golang/go/commit/7139b45d1410ded14e1e131151fd8dfc435ede6c
(golang-1.12)
NOTE:
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
NOTE:
https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
+ NOTE:
https://raw.githubusercontent.com/apache/trafficserver/8.0.x/CHANGELOG-8.0.4
+ NOTE: https://github.com/h2o/h2o/issues/2090
CVE-2019-9511 (Some HTTP/2 implementations are vulnerable to window size
manipulation ...)
- nginx <unfixed>
- nodejs <unfixed>
=====================================
data/dsa-needed.txt
=====================================
@@ -68,6 +68,8 @@ sssd
--
teeworlds/oldstable
--
+trafficserver
+--
wordpress
--
wpa
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/6fb4d47e535ec0709735f691bd1badd2e874cbf5
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/6fb4d47e535ec0709735f691bd1badd2e874cbf5
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
