Bug 1221401 (CVE-2024-27316)

Summary: VUL-0: CVE-2024-27316: apache2: VU#421644: HTTP/2 CONTINUATION frames can be utilized for DoS attacks
Product: [Novell Products] SUSE Security Incidents Reporter: SMASH SMASH <smash_bz>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: NEW --- QA Contact: Security Team bot <security-team>
Severity: Major    
Priority: P3 - Medium CC: meissner, pgajdos
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/397670/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-27316:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Bug Depends on:    
Bug Blocks: 1221404    

Description SMASH SMASH 2024-03-14 12:48:33 UTC
via VINCE

Vulnerability Information

CVE: CVE-2024-27316
ID: VU#421644.4
Case: VU#421644: HTTP/2 CONTINUATION frames can be utilized for DoS attacks
Date Added: 2024-02-28
Description: HTTP/2 CONTINUATION frames without the END_HEADERS flag set can be sent in a continuous stream by an attacker to an Apache Httpd implementation, which will not properly append header information in memory, causing an OOM crash.
Comment 1 Marcus Meissner 2024-03-14 12:51:52 UTC
CRD: 2024-03-28
Comment 5 Marcus Meissner 2024-03-26 12:41:52 UTC
CRD: 2024-04-04

still no apache2 patches in the VINCE issue.
Comment 6 Marcus Meissner 2024-04-02 13:32:43 UTC
still no apache2 patches in the VINCE issue.
Comment 7 Marcus Meissner 2024-04-04 07:11:32 UTC
is public via https://kb.cert.org/vuls/id/421644
Comment 9 Petr Gajdos 2024-04-30 08:43:51 UTC
  *) SECURITY: CVE-2024-27316: Apache HTTP Server: HTTP/2 DoS by
     memory exhaustion on endless continuation frames (cve.mitre.org)
     HTTP/2 incoming headers exceeding the limit are temporarily
     buffered in nghttp2 in order to generate an informative HTTP 413
     response. If a client does not stop sending headers, this leads
     to memory exhaustion.
     Credits: Bartek Nowotarski (https://nowotarski.info/)


https://svn.apache.org/viewvc?view=revision&revision=1916779
Comment 10 Petr Gajdos 2024-04-30 14:04:55 UTC
Submitted for ALP,15sp4,15sp2,12sp5/apache2.

15sp6 and 12sp2 remains.
Comment 12 Petr Gajdos 2024-05-02 09:06:33 UTC
(In reply to Petr Gajdos from comment #10)
> 15sp6 and 12sp2 remains.

Submitted also for 12sp2.
Comment 13 Petr Gajdos 2024-05-02 09:08:32 UTC
home:pgajdos:apache-test:after/apache-test looks good.
Comment 15 Petr Gajdos 2024-05-13 09:27:41 UTC
SUSE:SLFO:Main
https://build.suse.de/request/show/329897
Comment 16 Maintenance Automation 2024-05-13 16:30:00 UTC
SUSE-SU-2024:1627-1: An update that solves three vulnerabilities can now be installed.

Category: security (important)
Bug References: 1221401, 1222330, 1222332
CVE References: CVE-2023-38709, CVE-2024-24795, CVE-2024-27316
Maintenance Incident: [SUSE:Maintenance:33762](https://smelt.suse.de/incident/33762/)
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src):
 apache2-tls13-2.4.51-35.41.1, apache2-2.4.51-35.41.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src):
 apache2-tls13-2.4.51-35.41.1, apache2-2.4.51-35.41.1
SUSE Linux Enterprise Server 12 SP5 (src):
 apache2-tls13-2.4.51-35.41.1, apache2-2.4.51-35.41.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src):
 apache2-tls13-2.4.51-35.41.1, apache2-2.4.51-35.41.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 17 Maintenance Automation 2024-05-27 16:30:11 UTC
SUSE-SU-2024:1788-1: An update that solves three vulnerabilities can now be installed.

Category: security (important)
Bug References: 1221401, 1222330, 1222332
CVE References: CVE-2023-38709, CVE-2024-24795, CVE-2024-27316
Maintenance Incident: [SUSE:Maintenance:33761](https://smelt.suse.de/incident/33761/)
Sources used:
SUSE Enterprise Storage 7.1 (src):
 apache2-2.4.51-150200.3.62.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src):
 apache2-2.4.51-150200.3.62.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src):
 apache2-2.4.51-150200.3.62.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src):
 apache2-2.4.51-150200.3.62.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src):
 apache2-2.4.51-150200.3.62.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src):
 apache2-2.4.51-150200.3.62.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src):
 apache2-2.4.51-150200.3.62.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 18 Petr Gajdos 2024-05-28 06:44:57 UTC
15sp6
https://build.suse.de/request/show/331979

I believe all fixed.
Comment 19 Maintenance Automation 2024-06-10 12:30:02 UTC
SUSE-SU-2024:1963-1: An update that solves three vulnerabilities can now be installed.

Category: security (important)
Bug References: 1221401, 1222330, 1222332
CVE References: CVE-2023-38709, CVE-2024-24795, CVE-2024-27316
Maintenance Incident: [SUSE:Maintenance:34076](https://smelt.suse.de/incident/34076/)
Sources used:
openSUSE Leap 15.6 (src):
 apache2-event-2.4.58-150600.5.3.1, apache2-utils-2.4.58-150600.5.3.1, apache2-test_worker-2.4.58-150600.5.3.1, apache2-2.4.58-150600.5.3.1, apache2-worker-2.4.58-150600.5.3.1, apache2-test_event-2.4.58-150600.5.3.1, apache2-devel-2.4.58-150600.5.3.1, apache2-test_prefork-2.4.58-150600.5.3.1, apache2-manual-2.4.58-150600.5.3.1, apache2-prefork-2.4.58-150600.5.3.1, apache2-test_main-2.4.58-150600.5.3.1, apache2-test_devel-2.4.58-150600.5.3.1
Basesystem Module 15-SP6 (src):
 apache2-2.4.58-150600.5.3.1, apache2-prefork-2.4.58-150600.5.3.1
SUSE Package Hub 15 15-SP6 (src):
 apache2-2.4.58-150600.5.3.1, apache2-event-2.4.58-150600.5.3.1
Server Applications Module 15-SP6 (src):
 apache2-utils-2.4.58-150600.5.3.1, apache2-worker-2.4.58-150600.5.3.1, apache2-devel-2.4.58-150600.5.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.