Bug 1397474 (CVE-2016-6817)

Summary: CVE-2016-6817 tomcat: Infinite loop in HTTP/2 header parser
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: alee, bbaranow, bmaxwell, cdewolf, coolsvap, csutherl, dandread, darran.lofthouse, dosoudil, fnasser, gzaronik, hhorak, huwang, ivan.afonichev, jason.greene, java-sig-commits, jawilson, jboss-set, jclere, jdoyle, jorton, jshepherd, kanderso, krzysztof.daniel, lgao, mbabacek, mizdebsk, mnewsome, myarboro, nobody+bgollahe, ohudlick, pslavice, rnetuka, rsvoboda, rzima, twalsh, vondruch, vtunka, weli, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: tomcat 8.5.8 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-21 11:48:03 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1397493    
Bug Blocks: 1397645    

Description Adam Mariš 2016-11-22 15:44:56 UTC 
The HTTP/2 header parser entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.

Affects: 8.5.0 to 8.5.6

Upstream patch:

http://svn.apache.org/viewvc?view=rev&rev=1765798
Comment 1 Coty Sutherland 2016-11-22 15:47:30 UTC 
This only affects 8.5+, which isn't shipped any any Red Hat distribution yet.
Comment 2 Adam Mariš 2016-11-22 16:10:22 UTC 
Created tomcat tracking bugs for this issue:

Affects: fedora-all [bug 1397493]