https://bugzilla.redhat.com/show_bug.cgi?id=1397474
Bug ID: 1397474
Summary: CVE-2016-6817 tomcat: Infinite loop in HTTP/2 header
parser
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: alee(a)redhat.com, bgollahe(a)redhat.com,
csutherl(a)redhat.com, gzaronik(a)redhat.com,
hhorak(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jclere(a)redhat.com, jorton(a)redhat.com,
kanderso(a)redhat.com, krzysztof.daniel(a)gmail.com,
lgao(a)redhat.com, mbabacek(a)redhat.com, me(a)coolsvap.net,
mizdebsk(a)redhat.com, mnewsome(a)redhat.com,
myarboro(a)redhat.com, ohudlick(a)redhat.com,
rzima(a)redhat.com, trick(a)vanstaveren.us,
twalsh(a)redhat.com, weli(a)redhat.com
The HTTP/2 header parser entered an infinite loop if a header was received that
was larger than the available buffer. This made a denial of service attack
possible.
Affects: 8.5.0 to 8.5.6
Upstream patch:
http://svn.apache.org/viewvc?view=rev&rev=1765798
--
You are receiving this mail because:
You are on the CC list for the bug.