Bugzilla – Bug 1220403
VUL-0: CVE-2024-23837: libhtp: excessive processing time of HTTP headers can lead to denial of service
Last modified: 2024-06-04 09:18:12 UTC
LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-23837 https://www.cve.org/CVERecord?id=CVE-2024-23837 https://github.com/OISF/libhtp/commit/20ac301d801cdf01b3f021cca08a22a87f477c4a https://github.com/OISF/libhtp/security/advisories/GHSA-f9wf-rrjj-qx8m https://redmine.openinfosecfoundation.org/issues/6444
Already in Factory > https://build.opensuse.org/request/show/1149545 Assigning back to security team
(In reply to Otto Hollmann from comment #1) > Already in Factory > > https://build.opensuse.org/request/show/1149545 > > Assigning back to security team What about openSUSE:Backports:SLE-15-SP{4,5,6}?
(In reply to Carlos López from comment #2) > What about openSUSE:Backports:SLE-15-SP{4,5,6}? openSUSE has a weak model and tracking and following up here. Otto did not read your message: He was neither the assignee, nor CC'd on the bug, nor would the maintainer ever be pinged again unless someone looked at this randomly. Re-assigning back to Maintainer to action. Here's a backport: https://build.opensuse.org/request/show/1178079
cl fix: https://build.opensuse.org/request/show/1178077 15.5: https://build.opensuse.org/request/show/1178079 15.6: https://build.opensuse.org/request/show/1178080
This is an autogenerated message for OBS integration: This bug (1220403) was mentioned in https://build.opensuse.org/request/show/1178243 Backports:SLE-15-SP5+Backports:SLE-15-SP6 / libhtp
openSUSE-SU-2024:0150-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1220403 CVE References: CVE-2024-23837 JIRA References: Sources used: openSUSE Backports SLE-15-SP5 (src): libhtp-0.5.42-bp155.2.3.1
done