svn commit: r452686 - head/security/vuxml

Sun Oct 22 22:25:54 UTC 2017

Author: dch
Date: Sun Oct 22 22:25:53 2017
New Revision: 452686
URL: https://svnweb.freebsd.org/changeset/ports/452686

Log:
  Multiple vulnerabilites in www/h2o
  
  Reviewed by:	jrm (mentor)
  Approved by:	jrm (mentor)
  Security:	CVE-2017-10868
  Security:	CVE-2017-10869
  Differential Revision:	https://reviews.freebsd.org/D12763

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Sun Oct 22 22:08:36 2017	(r452685)
+++ head/security/vuxml/vuln.xml	Sun Oct 22 22:25:53 2017	(r452686)
@@ -58,6 +58,38 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="10c0fabc-b5da-11e7-816e-00bd5d1fff09">
+    <topic>h2o -- DoS in workers</topic>
+    <affects>
+      <package>
+       <name>h2o</name>
+      <range><lt>2.2.3</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+       <p>Frederik Deweerdt reports:</p>
+       <blockquote cite="https://github.com/h2o/h2o/releases/tag/v2.2.3">
+       <p>Multiple Denial-of-Service vulnerabilities exist in h2o workers -
+       see references for full details.</p>
+       <p>CVE-2017-10868: Worker processes may crash when receiving a request with invalid framing.</p>
+       <p>CVE-2017-10869: The stack may overflow when proxying huge requests.</p>
+       </blockquote>
+      </body>
+   </description>
+    <references>
+      <cvename>CVE-2017-10868</cvename>
+      <cvename>CVE-2017-10869</cvename>
+      <url>https://github.com/h2o/h2o/issues/1459</url>
+      <url>https://github.com/h2o/h2o/issues/1460</url>
+      <url>https://github.com/h2o/h2o/releases/tag/v2.2.3</url>
+    </references>
+    <dates>
+      <discovery>2017-07-19</discovery>
+      <entry>2017-10-17</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="85e2c7eb-b74b-11e7-8546-5cf3fcfdd1f1">
     <topic>irssi -- multiple vulnerabilities</topic>
     <affects>
