News for hackers. Stuff that matters.

A comment on HTTP/2 Denial of Service Advisory.

Re:HTTP/2 Denial of Service Advisory by mjevans on Tuesday August 13, 2019 @02:27PM (#20688802)
Is there a better list of fixed versions for E.G. Apache / Lighttpd (n/a No http/2 support) / Nginx?
[ Parent | on HN ]
Re:HTTP/2 Denial of Service Advisory by m11r on Tuesday August 13, 2019 @02:46PM (#20688980)
For nginx, versions 1.16.1+ and 1.17.3+ from upstream fix at least three of the vulnerabilities (CVE-2019-9511, CVE-2019-9513, CVE-2019-9516), however if you use a version provided by a distribution’s repositories (e.g., nginx 1.16 included with Ubuntu 18.04 LTS) you’ll need to watch for those security advisories and fixes separately which may have different version numbers due to the backporting.
[ Parent | on HN ]
Re:HTTP/2 Denial of Service Advisory by rdli on Tuesday August 13, 2019 @03:20PM (#20689278)
This is addressed in Envoy 1.11.1 (https://www.envoyproxy.io/docs/envoy/v1.11.1/intro/version_h...) and Ambassador 0.75 (https://blog.getambassador.io/multiple-http-2-vulnerabilitie...).
[ Parent | on HN ]