diff options
| author | adam <adam@pkgsrc.org> | 2019-08-14 07:43:33 +0000 |
|---|---|---|
| committer | adam <adam@pkgsrc.org> | 2019-08-14 07:43:33 +0000 |
| commit | df3aca6c1b3f30760ee4f10de5359ae95bfa09ba (patch) | |
| tree | 7dda6b5eeeb7f355e62937553190692c60d622b9 /www/nghttp2 | |
| parent | 5156bc47da3549efb2ce6d7f75b0b44f0685135f (diff) | |
| download | pkgsrc-df3aca6c1b3f30760ee4f10de5359ae95bfa09ba.tar.gz | |
nghttp2: updated to 1.39.2
nghttp2 v1.39.2
This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513
“Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2
frames cause Denial of Service by consuming CPU time. Check out
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
for details. For nghttpx, additionally limiting inbound traffic by --read-rate and --read-burst options is quite effective against this kind of attack.
Fix CVE-2019-9511 and CVE-2019-9513
Add nghttp2_option_set_max_outbound_ack API function
nghttpx: Fix request stall
Diffstat (limited to 'www/nghttp2')
| -rw-r--r-- | www/nghttp2/Makefile | 5 | ||||
| -rw-r--r-- | www/nghttp2/distinfo | 10 |
2 files changed, 7 insertions, 8 deletions
diff --git a/www/nghttp2/Makefile b/www/nghttp2/Makefile index 8a72d2a0b26..7de1a8e1ecb 100644 --- a/www/nghttp2/Makefile +++ b/www/nghttp2/Makefile @@ -1,7 +1,6 @@ -# $NetBSD: Makefile,v 1.54 2019/07/01 04:07:53 ryoon Exp $ +# $NetBSD: Makefile,v 1.55 2019/08/14 07:43:33 adam Exp $ -DISTNAME= nghttp2-1.39.1 -PKGREVISION= 1 +DISTNAME= nghttp2-1.39.2 CATEGORIES= www MASTER_SITES= ${MASTER_SITE_GITHUB:=tatsuhiro-t/} EXTRACT_SUFX= .tar.xz diff --git a/www/nghttp2/distinfo b/www/nghttp2/distinfo index aa0ec495b78..4f1df53bf7d 100644 --- a/www/nghttp2/distinfo +++ b/www/nghttp2/distinfo @@ -1,6 +1,6 @@ -$NetBSD: distinfo,v 1.41 2019/06/13 09:28:52 adam Exp $ +$NetBSD: distinfo,v 1.42 2019/08/14 07:43:33 adam Exp $ -SHA1 (nghttp2-1.39.1.tar.xz) = 7f2390d1de857212f684e015540a9213372add7b -RMD160 (nghttp2-1.39.1.tar.xz) = 05226b15b1e860793b4d638bdcccba51f4eddfc9 -SHA512 (nghttp2-1.39.1.tar.xz) = 36558ed03c59086086abbf144ec7c54c60de3fea00a9ea594feea7186a779781cbb66a08c9b34265892dea382b42b875f551e85331cfa0086e357f9b27b919fa -Size (nghttp2-1.39.1.tar.xz) = 1634512 bytes +SHA1 (nghttp2-1.39.2.tar.xz) = 21cc8e8b1f71e3812c5c957280d6addd916311fa +RMD160 (nghttp2-1.39.2.tar.xz) = 5bda6a53aeaa2d7c194c990346951080a96f0912 +SHA512 (nghttp2-1.39.2.tar.xz) = d8c971543e3e87736dfafebca55e9ecd0644e304c9731edaccba34170205824476595861a439077289b438ad489dd6008dedf2c6b2c111920300329be1b1bf34 +Size (nghttp2-1.39.2.tar.xz) = 1635428 bytes |