Actions
Security #6900
closedhttp2: timeout logging headers
Git IDs:
03442c9071b8d863d26b609d54c6eacf4de9e340
Severity:
HIGH
Disclosure Date:
06/28/2024
Description
Found by oss-fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67661
Investigating more in this issue
Updated by Philippe Antoine 6 months ago
- Related to Bug #6846: alerts: wrongly using tx id 0 when there is no tx added
Updated by Philippe Antoine 6 months ago
Fix for #6846 fixes this timeout because we get multiple alerts for sid 2210045 and 2210029 which logs http2 app-layer data when it should not
Updated by Philippe Antoine 6 months ago
- Related to Security #6892: http2: oom on copying compressed headers added
Updated by Philippe Antoine 6 months ago
http2 logging does not take too much time because a single field is too long, but we log 35367 headers.
This get bad because of http2 headers compression where one byte in the network can refer up to HTTP2_MAX_TABLESIZE
(65536 by default, configurable with app-layer.protocols.http2.max-table-size
bytes previously seen on the network.
Updated by Philippe Antoine 6 months ago
- Status changed from New to In Review
- Label Needs backport to 7.0 added
Updated by Victor Julien 6 months ago
- Status changed from In Review to Closed
- Git IDs updated (diff)
Updated by Philippe Antoine 5 months ago
- Related to Bug #6973: detect: log relevant frames app-layer metdata added
Updated by Philippe Antoine 5 months ago ยท Edited
For info, the oss-fuzz report is still open until #6848 gets solved
Updated by Victor Julien 5 months ago
- Private changed from Yes to No
Actions