Home / mailings

PDF

APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0

Posted on 13 August 2019
Apple Security-announce

APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0

SwiftNIO HTTP/2 1.5.0 is now available and addresses the following:

SwiftNIO HTTP/2
Available for: SwiftNIO HTTP/2 1.0.0 through 1.4.0 on
macOS Sierra 10.12 and later and Ubuntu 14.04 and later
Impact: A HTTP/2 server may consume unbounded amounts of memory when
receiving certain traffic patterns and eventually suffer resource
exhaustion
Description: This issue was addressed with improved buffer size
management.
CVE-2019-9512: Jonathan Looney of Netflix
CVE-2019-9514: Jonathan Looney of Netflix
CVE-2019-9515: Jonathan Looney of Netflix
CVE-2019-9516: Jonathan Looney of Netflix

SwiftNIO HTTP/2
Available for: SwiftNIO HTTP/2 1.0.0 through 1.4.0 on
macOS Sierra 10.12 and later and Ubuntu 14.04 and later
Impact: A HTTP/2 server may consume excessive CPU resources when
receiving certain traffic patterns
Description: This issue was addressed with improved input validation.
CVE-2019-9518: Piotr Sikora of Google, Envoy Security Team

Installation note:

SwiftNIO HTTP/2 1.5.0 may be obtained via Swift Package Manager.

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222 and
https://github.com/apple/swift-nio-http2/releases/tag/1.5.0.

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

 

TOP