-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 30 Apr 2024 18:59:06 +0200
Source: nghttp2
Architecture: source
Version: 1.36.0-2+deb10u3
Distribution: buster-security
Urgency: high
Maintainer: Tomasz Buchert <tomasz@debian.org>
Changed-By: Guilhem Moulin <guilhem@debian.org>
Closes: 1068415
Changes:
nghttp2 (1.36.0-2+deb10u3) buster-security; urgency=high
.
* Non-maintainer upload by the LTS Security Team.
* Fix CVE-2024-28182: An implementation using the nghttp2 library will
continue to receive CONTINUATION frames, and will not callback to the
application to allow visibility into this information before it resets the
stream, resulting in Denial of Service. (Closes: #1068415)
* d/libnghttp2-14.symbols: Add missig symbol from the backported upstream
fix.
Checksums-Sha1:
0c3967e9c47cef280d096227e09b0160ba925c9e 2576 nghttp2_1.36.0-2+deb10u3.dsc
432531d3e42d45719c3ac3b31934199a00928d3a 22668 nghttp2_1.36.0-2+deb10u3.debian.tar.xz
fc6c1a9d4119651c29ab99ee93720475f5e0872f 10996 nghttp2_1.36.0-2+deb10u3_amd64.buildinfo
Checksums-Sha256:
f6ab7fca79781b13788a96f3aeeaab0610f903bcd022939cde0d6670ce1c486b 2576 nghttp2_1.36.0-2+deb10u3.dsc
49f33901378a63f365dccd5cd8e6dd795835f17b2aff67ef4d72aa2402ad94c7 22668 nghttp2_1.36.0-2+deb10u3.debian.tar.xz
0347d3889afe3a1388d1f9f9701c372e5685fa5074e7673c6b726e1bfc989d39 10996 nghttp2_1.36.0-2+deb10u3_amd64.buildinfo
Files:
fceb3f766900e7c901d1a8f701e11b30 2576 httpd optional nghttp2_1.36.0-2+deb10u3.dsc
22f4b45b39ca9ebd1f3771a4a838185c 22668 httpd optional nghttp2_1.36.0-2+deb10u3.debian.tar.xz
bad6c1092c519da85259f4c4b4493d2c 10996 httpd optional nghttp2_1.36.0-2+deb10u3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmYxI9IACgkQ05pJnDwh
pVKZ/Q/+M5Lbm2qFjdB2Fkzc7n7Ukm8+HICzMHHyugV3OZIv+P2HZ+IDHOMbgxKY
JJrquyWlleM4ptynBmHY4i7viuOvgzButBQDUSpw7k/ylZ1upYHY3klDdL44pext
gdevc7iOZjQ3kNQ+Zu8656ivAJk6pkpp5dOjVl0axlxVYiyUGsdHW6muf5CNLcOT
U3D7X3+lZNXWh/R73n6V0t0v9ozqJ73bxpbX5QDh75oLKVusgeFJftOzfFHUewnt
Aor6oLq2a6Q3skhfThLK8BTVPKhZ9wYyrkmH2FKiphKj7jVw2dWWrcrBN5tmKNFE
xSGG/Ks+ADofNSvn96dma3XRLJa6REgo5MNw4YFklX//tRtMUIpdTeZkoXg5gW5M
vc18DAM3IR9Rq3m/Q4gXRC6WNqCU71nxlSUDgZNsmFFPELkFhng7At72CSpK3CrE
Ot5Lzy4XANY8BRlhQ2lyPQoEcgs10TEWfTlZqnKQU3PaY0+8pwqPwiybX3r514/3
PaCQE33cq4XOLvCEIqdtRiJcfQmzyWDPHyFWkMz/fJl87BRdTGg0u2gU3S66jiI0
g8AofYEhven313OeFB4IWeXj/6YcVzLh57yIB/dWUFjWniX81CRAUk9Lzd2OEsBn
3sPRYZ98CAfKYjZKel8gzcWkFIIu0Ib6ZV11yTdTxMWpnBsaE1E=
=2puy
-----END PGP SIGNATURE-----
Attachment:
pgpUkIHd11Rl4.pgp
Description: PGP signature