FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

nothing found there

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
1d3677a8-9143-42d8-84a3-0585644dff4b	h2o -- uninitialised memory access in HTTP3 Emil Lerner reports: When receiving QUIC frames in certain order, HTTP/3 server-side implementation of h2o can be misguided to treat uninitialized memory as HTTP/3 frames that have been received. When h2o is used as a reverse proxy, an attacker can abuse this vulnerability to send internal state of h2o to backend servers controlled by the attacker or third party. Also, if there is an HTTP endpoint that reflects the traffic sent from the client, an attacker can use that reflector to obtain internal state of h2o. This internal state includes traffic of other connections in unencrypted form and TLS session tickets. This vulnerability exists in h2o server with HTTP/3 support, between commit 93af138 and d1f0f65. None of the released versions of h2o are affected by this vulnerability. Discovery 2021-01-31 Entry 2022-02-02 h2o-devel lt 2.3.0.d.20220131 CVE-2021-43848 https://github.com/h2o/h2o/security/advisories/GHSA-f9xw-j925-m4m4

VuXML ID

Description

1d3677a8-9143-42d8-84a3-0585644dff4b

h2o -- uninitialised memory access in HTTP3

Emil Lerner reports:

When receiving QUIC frames in certain order, HTTP/3 server-side implementation of h2o can be misguided to treat uninitialized memory as HTTP/3 frames that have been received. When h2o is used as a reverse proxy, an attacker can abuse this vulnerability to send internal state of h2o to backend servers controlled by the attacker or third party. Also, if there is an HTTP endpoint that reflects the traffic sent from the client, an attacker can use that reflector to obtain internal state of h2o.

This internal state includes traffic of other connections in unencrypted form and TLS session tickets.

This vulnerability exists in h2o server with HTTP/3 support, between commit 93af138 and d1f0f65. None of the released versions of h2o are affected by this vulnerability.

Discovery 2021-01-31
Entry 2022-02-02
h2o-devel

lt 2.3.0.d.20220131

CVE-2021-43848
https://github.com/h2o/h2o/security/advisories/GHSA-f9xw-j925-m4m4