![]() ![]() The attack is low-effort: it takes very little resources to send one of these frames. For servers, anyone they allow to connect to them may launch such an attack. For clients, this means any server to which they connect may launch this attack. Sending an ALTSVC or ORIGIN frame does not require any special permission, so any HTTP/2 connection peer may send such a frame. This was left behind from the original development process and was never removed. However, one code path that encounters them has a deliberate trap instead. ORIGIN and ALTSVC frames are not currently supported by swift-nio-http2, and should be ignored. This vulnerability is caused by a logical error after frame parsing but before frame handling. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames.
0 Comments
Leave a Reply. |