Bug 1397474 (CVE-2016-6817)

Summary:	CVE-2016-6817 tomcat: Infinite loop in HTTP/2 header parser
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	alee, asoldano, bbaranow, bmaxwell, brian.stansberry, cdewolf, coolsvap, csutherl, dandread, darran.lofthouse, dkreling, dosoudil, fjuma, fnasser, gzaronik, hhorak, huwang, istudens, ivan.afonichev, ivassile, iweiss, jason.greene, java-sig-commits, jawilson, jboss-set, jclere, jdoyle, jorton, jshepherd, kanderso, krzysztof.daniel, lgao, mbabacek, mizdebsk, mnewsome, mosmerov, msochure, msvehla, myarboro, nobody+bgollahe, nwallace, ohudlick, pesilva, pjindal, plodge, pmackay, pslavice, rnetuka, rstancel, rsvoboda, rzima, smaestri, szappis, tom.jenkinson, twalsh, vondruch, vtunka, weli, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	tomcat 8.5.8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 11:48:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1397493
Bug Blocks:	1397645

Description Adam Mariš 2016-11-22 15:44:56 UTC

The HTTP/2 header parser entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.

Affects: 8.5.0 to 8.5.6

Upstream patch:

http://svn.apache.org/viewvc?view=rev&rev=1765798

Comment 1 Coty Sutherland 2016-11-22 15:47:30 UTC

This only affects 8.5+, which isn't shipped any any Red Hat distribution yet.

Comment 2 Adam Mariš 2016-11-22 16:10:22 UTC

Created tomcat tracking bugs for this issue:

Affects: fedora-all [bug 1397493]