H2o: Format String Vulnerability (CVE-2016-4864)

[kazuho]

Format string vulnerability exists in H2O upto and including version 2.0.3 / 2.1.0-beta2, that can be used by remote attackers to mount Denial-of-Service attacks.

Users using one of the following handlers of H2O may be affected by the issue and are advised to upgrade immediately to version 2.0.4 or 2.1.0-beta3.

Affected handlers:

• fastcgi
• mruby
• proxy
• redirect
• reproxy

Deployments only using the file handler is not affected by the vulnerability.

[tatsushid]

Hello,

I've updated following my binary package builder repositories too.

• https://github.com/tatsushid/h2o-rpm
• https://github.com/tatsushid/h2o-deb

It is highly recommended to update if you use them.

[judofyr]

What's the commit for the fix?

[dch]

This landed in FreeBSD ports tree 10h00 UTC https://svnweb.freebsd.org/ports?view=revision&revision=422122 and will be backported to quarterly branch once ports-secteam approve it. Follow https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=211892 for more details.

[lkwg82]

I've updated: https://hub.docker.com/r/lkwg82/h2o-http2-server/tags/

[kazuho]

@judofyr

What's the commit for the fix?

I am sorry but I am not sure if answering to the question at a public place would be a good thing to do at the moment. Please send me a mail if you need such information stating why you need it.

[ge-fa]

@kazuho Well, it's open-source after all, so what would be the risk in making the commit public? Your comment makes me feel quite strange.

[lkwg82]

11 months later it is ok, to make the fix public. So linking is ok now.