News for hackers. Stuff that matters.

A comment on HTTP/2-exclusive threats caused by implementation flaws and RFC imperfections. Parent comment

Re:HTTP/2-exclusive threats caused by implementation flaws a... by tsimionescu on Friday August 06, 2021 @03:15AM (#28084184)
The whole point of this article is that proxies speaking HTTP2 with clients and HTTP1.1 with servers introduce new vulnerabilities. The author found such vulnerabilities in AWS ALB, several WAF solutions, F5 BigIP, and others.
[ Parent | on HN ]
Re:HTTP/2-exclusive threats caused by implementation flaws a... by darkwater on Friday August 06, 2021 @03:49AM (#28084357)
Yeah but serving traffic from an application server directly is probably even worse in plethora of other failure modes.

EDIT: and yes I understand that you should use http/2 on the LB and http/2 on the backend to get the best of both worlds.

EDIT2: anyway my opinion is that the general reaction to a security discovery like this one shouldn't be "let's stop using this tech immediately" but "let's get this patched ASAP"

[ Parent | on HN ]
Re:HTTP/2-exclusive threats caused by implementation flaws a... by takeda on Friday August 06, 2021 @04:23AM (#28084542)
No one was talking about serving from application directly. The issue is in scenario you are describing. Please read the article.
[ Parent | on HN ]