Your message dated Tue, 13 Feb 2024 15:06:34 +0000
with message-id <[email protected]>
and subject line Bug#1062667: fixed in rust-h2 0.3.24-1
has caused the Debian Bug report #1062667,
regarding rust-h2: Resource exhaustion vulnerability in h2 may lead to Denial
of Service
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1062667: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1062667
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: rust-h2
Severity: important
X-Debbugs-Cc: [email protected]
Dear Maintainer,
An attacker with an HTTP/2 connection to an affected endpoint can send
a steady stream of invalid frames to force the generation of reset frames
on the victim endpoint. By closing their recv window, the attacker could
then force these resets to be queued in an unbounded fashion, resulting
in Out Of Memory (OOM) and high CPU usage.
This fix is corrected in hyperium/h2#737, which limits the total number
of internal error resets emitted by default before the connection is
closed.
-- System Information:
Debian Release: trixie/sid
APT prefers unstable
APT policy: (500, 'unstable'), (500, 'testing')
Architecture: amd64 (x86_64)
Kernel: Linux 6.6.11-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
--- End Message ---
--- Begin Message ---
Source: rust-h2
Source-Version: 0.3.24-1
Done: Peter Michael Green <[email protected]>
We believe that the bug you reported is fixed in the latest version of
rust-h2, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Peter Michael Green <[email protected]> (supplier of updated rust-h2 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Tue, 13 Feb 2024 14:39:39 +0000
Source: rust-h2
Architecture: source
Version: 0.3.24-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Rust Maintainers
<[email protected]>
Changed-By: Peter Michael Green <[email protected]>
Closes: 1062667
Changes:
rust-h2 (0.3.24-1) unstable; urgency=medium
.
* Package h2 0.3.24 from crates.io using debcargo 2.6.1
* Relax dependency on indexmap.
.
[ Alexander Kjäll ]
* Team upload.
* Package h2 0.3.24 from crates.io using debcargo 2.6.1
* fixes RUSTSEC-2024-0003 (Closes: #1062667)
Checksums-Sha1:
6e6892b4ec807f523162fac5e2cc9c95975275bd 3227 rust-h2_0.3.24-1.dsc
77d23f00328ddd4243944969a64e9b2ab8b6173b 167814 rust-h2_0.3.24.orig.tar.gz
d5dcf5957a4a24deba06cb669e6633937d24cbde 4288 rust-h2_0.3.24-1.debian.tar.xz
661d4e3a0eee999256b76b17881139bad6bcd528 13067
rust-h2_0.3.24-1_source.buildinfo
Checksums-Sha256:
b7205201aad31008a593af830db2b3f6f5aeed668cb4585efaa6023b316765c4 3227
rust-h2_0.3.24-1.dsc
bb2c4422095b67ee78da96fbb51a4cc413b3b25883c7717ff7ca1ab31022c9c9 167814
rust-h2_0.3.24.orig.tar.gz
cf729439c2eb1434a788508367452c3b9c81a5eac604e0156351c860143c1fb0 4288
rust-h2_0.3.24-1.debian.tar.xz
e2c0a92687251fcf31c3d98e44d680c8337f33960e1777bb441071719406b320 13067
rust-h2_0.3.24-1_source.buildinfo
Files:
727015b9ad017246567350f6d2de20b0 3227 rust optional rust-h2_0.3.24-1.dsc
f8d17c98def1d7d057d2f5da3d29bc9b 167814 rust optional
rust-h2_0.3.24.orig.tar.gz
d62f636e1421fff5c1a4d62ffa1980a0 4288 rust optional
rust-h2_0.3.24-1.debian.tar.xz
f8922033224eccafbf0c54b807d77695 13067 rust optional
rust-h2_0.3.24-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCAAyFiEEU0DQATYMplbjSX63DEjqKnqP/XsFAmXLgKcUHHBsdWd3YXNo
QGRlYmlhbi5vcmcACgkQDEjqKnqP/Xu/yA/7BemfAry3nBlvfDZ/wju80Eo4EGfb
mg5qSV4w3w+IVvro3F8gdn08ZF/1LIJCItDH8NNLaKTF+uMdYikcsYEhkGD9E18d
21scf+XIMqeDsrzVl2VbMR3zoRsMb5UYRLwyT/VSjWBfzTkC1IJtz/pq/lUo+foq
GZlP5D45FzgmgIlY0UYF5w5p8VUv5GyKFJPn+BhiU1sHYJUq4kvriiGgAjelwlsG
3+wUOh2t+Hs3/ZjuG29cLMiWPitJFVXXRo8zo6LCWFh651fOdaNCAY4yXLZOoAEy
TiQ6HlT1EwHzZ90LPSjftd3RgBeM8q0Mp3Gqr2JT002BFl64r+aCIOqqXUa2BUuU
GKw+3h3kt1e2OIpxRrc0OKe4hKr8wjMy+72ifRc9BO9UgVo/4oiWds+V14FiFttD
fX/VRzWDt41kyiMOBxV7a/R07iNciyHnJkoXdWmFqYUch2IsOoO2h0ZLlnRsMupw
/coGZPAWCNoSHJcfwTn8ehE5emqCW6jaBp2+QCVVtXmCMFVEV3PmFTA3/C9UxO/Q
3D71PjkVAvoA/8jacj3wBKp/PvHjWS6RtjNNDoKupj+szPZ4yEu7dE1kLi3YMfRs
pNA6ljXVF5shGeGBEFwMgUcVJRBZa5b1w/C6ldTV4IO8HmU23ecw8ymNCxukbESM
gyiTUQG7KnkZ6lk=
=Xj9i
-----END PGP SIGNATURE-----
pgpZn5hPVOIJJ.pgp
Description: PGP signature
--- End Message ---
