Jasper Orschulko 3fdd260209 nginx: Mitigate HTTP/2 Stream Resets Flood impact ...

Reduces the impact of HTTP/2 Stream Reset flooding in the nginx product
(CVE-2023-44487).

See: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/

This patch only reduces the impact and does not completely mitigate the CVE
in question, the latter being due to a design flaw in the HTTP/2 protocol
itself. For transparancy reasons I therefore opted to not mark the
CVE as resolved, so that integrators can decide for themselves, wheither to
enable HTTP/2 support or allow HTTP/1.1 connections only.

Signed-off-by: Jasper Orschulko <jasper@fancydomain.eu>
Signed-off-by: Armin Kuster <akuster808@gmail.com>

2023-12-13 13:35:51 -05:00

..

apache2

apache2: upgrade 2.4.56 -> 2.4.57

2023-05-06 07:35:55 -04:00

apache-mod

apache-websocket: remove obsolete support for renamed libtool

2021-12-13 21:20:01 -08:00

cherokee

recipes: Update LICENSE variable to use SPDX license identifiers

2022-03-04 17:41:45 -08:00

hiawatha

recipes: Update LICENSE variable to use SPDX license identifiers

2022-03-04 17:41:45 -08:00

monkey

monkey: use git fetcher

2023-03-29 16:19:10 -04:00

nginx

nginx: Mitigate HTTP/2 Stream Resets Flood impact

2023-12-13 13:35:51 -05:00

sthttpd

recipes: Update SRC_URI branch and protocols

2021-11-03 06:57:49 -07:00