it-securitynotifies AT lists.piratenpartei.de
Betreff: Sicherheitsankündigungen
Listenarchiv
- From: Moritz Muehlenhoff <jmm AT debian.org>
- To: debian-security-announce AT lists.debian.org
- Subject: [IT-SecNots] [SECURITY] [DSA 5570-1] nghttp2 security update
- Date: Fri, 1 Dec 2023 20:29:08 +0000
- List-archive: https://lists.debian.org/msgid-search/ZWpCFAmoa+vyWhzJ AT seger.debian.org
- List-id: <debian-security-announce.lists.debian.org>
- List-url: <http://lists.debian.org/debian-security-announce/>
- Old-dkim-signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.seger; h=Content-Type:MIME-Version:Message-ID:Subject:To:From:Date :Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description: In-Reply-To:References; bh=yNsLGU/tfqKaS+BUKlUjs9qfeScXlitY7WFDaXH8uN0=; b=T+ ZbSaVRp99kpv73eyKX71BjNIFSv8Z4H3PEAW7f9UXHAj0l10r3aTLbgtbZkRLCySMxvKfEPTpd92g GcuaqVES16Ye6NhsBfRB2ma6WR/8j2zXKI38VquTP4tqEAePemw5PM5q/34U0YcKdd2JsvHO86I7l 3mN8OxVjUcSOiHSJ4JwaPHVXuLcX6i+s33JCpq2Ia0utZOwdukxahLO/TOPsn0srN7hHbTkj9fzu8 bnHBcY9unsv97yqZQ3jNGV6AOQaYhn2UcsO7yDxMuRAg1fbV8/MfhtwLVfVj2TgnGZa7Iw+MQ5H9Q jy+ZlMGAnWUJJ5gu49zzizLAtuTY6u8g==;
- Old-return-path: <jmm AT seger.debian.org>
- Priority: urgent
- Resent-date: Fri, 1 Dec 2023 20:29:38 +0000 (UTC)
- Resent-from: debian-security-announce AT lists.debian.org
- Resent-message-id: <yGCGCsDs5nE.A.crH.xIkalB@bendel>
- Resent-sender: debian-security-announce-request AT lists.debian.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5570-1 security AT debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
December 01, 2023 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : nghttp2
CVE ID : CVE-2023-44487
It was discovered that libnghttp2, a library implementing the HTTP/2
protocol, handled request cancellation incorrectly. This could result
in denial of service.
For the oldstable distribution (bullseye), this problem has been fixed
in version 1.43.0-1+deb11u1.
For the stable distribution (bookworm), this problem has been fixed in
version 1.52.0-1+deb12u1.
We recommend that you upgrade your nghttp2 packages.
For the detailed security status of nghttp2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/nghttp2
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmVqQcgACgkQEMKTtsN8
TjbEqA//QDCmDN5CLJGvcajpO5Ys2AbOXT+i7cTVhPDjFSnNs0CajiY/ay2qfYNX
2L5Bk5XPbFmLWD1QhvpMysXYFOJKxyqzhhTU23Ha2cQS4M5t2SHzkoKPyD+Vk6wg
BF2TwwlZiSJTMcQqMcw2OAUAfwwaxPVIT0wB8VNY/I7HO3pvTKXSFl9Wb0Y2RzZT
kL8ci804D57Uqi45dM391V4B3UfoQ/EK+bYhbu8qDfp3/gL7gclRy2+v+by1JwsN
RUKM+nbb4eB0L7XM4rWmZrB4o0Tp5KblwNYRmUh7aCxqIuHRvwzRmQYoEB0KXJ7j
Udv0/cUISbjkcIZ+lTIduhWRRvQxjo6M9rB0Tk6jFjTwXWRpWKPcYBYz1L8QKN+x
lizyctsoT6TJR+IeJmbAfkY8hcTT1j/PZSn1udnRCodpXjUccn8cot4NlU6VWtzw
X5hZCYGTlyeY3oKuPusES6bNsYqzJNp4ObU0xOTvES/ru8Zmiz/76Eufg3+oDo3S
gYKVFcchgp0mk20owdWHTadQpIfQFoJkL2FWYWFhXuTGTe30R9bsMIbDddaD3cYs
6p7AiwYljhYYWqaVmRCAhiGerpun18NZhKUlV7ZMF8yQflrVddPqoVTVQEpWx6ZL
cuJ2u/oag8DdQsfXrQvZWcVWdp77itr+ZeBhm7Xok0+jPDscFDo=
=P2Nw
-----END PGP SIGNATURE-----
- [IT-SecNots] [SECURITY] [DSA 5570-1] nghttp2 security update, Moritz Muehlenhoff, 01.12.2023
Archiv bereitgestellt durch MHonArc 2.6.19+.