Bug 7152 - [Anolis OS 23] Bugfix for CVE-2023-43622
Summary: [Anolis OS 23] Bugfix for CVE-2023-43622
Status: RESOLVED FIXED
Alias: None
Product: Anolis OS 23
Classification: Anolis OS
Component: BaseOS Packages (show other bugs) BaseOS Packages
Version: unspecified
Hardware: All Linux
: P2-High S2-major
Target Milestone: ---
Assignee: happy_orange
QA Contact: bolong_tbl
URL:
Whiteboard:
Keywords: CVE
Depends on:
Blocks:
 
Reported: 2023-11-06 20:15 UTC by 小龙
Modified: 2023-11-06 20:16 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description 小龙 admin 2023-11-06 20:15:34 UTC 
Description:
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern.
This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.

Users are recommended to upgrade to version 2.4.58, which fixes the issue.



Broken commit info:

Bugfix commit info:
Comment 1 小龙 admin 2023-11-06 20:16:12 UTC 
PR: 
https://gitee.com/src-anolis-os/httpd/pulls/30