H2O alllows bypassing address-based access control with 0-RTT
Published Oct 11, 2024
7.5
HIGHCVSS 3.1
EPSS 0.44%
Description
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and prohibit HTTP requests conveyed by packets with a spoofed source address. This behavior allows attackers on the network to execute HTTP requests from addresses that are otherwise rejected by the address-based access control. The vulnerability has been addressed in commit 15ed15a. Users may disable the use of TCP FastOpen and QUIC to mitigate the issue.
Affected products
-
Affected
- <
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (4)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-41458 Advisory
- https://github.com/h2o/h2o/commit/15ed15a2efb83a77bb4baaa5a119e639c2f6898a x_refsource_MISCPatch
- https://github.com/h2o/h2o/security/advisories/GHSA-jf2c-xjcp-wg4c x_refsource_CONFIRMVendor Advisory
- https://h2o.examp1e.net/configure/http3_directives.html x_refsource_MISCProduct
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-41458 | Advisory | |
| https://github.com/h2o/h2o/commit/15ed15a2efb83a77bb4baaa5a119e639c2f6898a | x_refsource_MISCPatch | |
| https://github.com/h2o/h2o/security/advisories/GHSA-jf2c-xjcp-wg4c | x_refsource_CONFIRMVendor Advisory | |
| https://h2o.examp1e.net/configure/http3_directives.html | x_refsource_MISCProduct |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
Red Hat
No data
GitHub
No data