diff options
| author | Anna Henningsen <anna@addaleax.net> | 2019-08-12 23:36:00 +0200 |
|---|---|---|
| committer | Beth Griggs <Bethany.Griggs@uk.ibm.com> | 2019-08-15 15:21:17 +0100 |
| commit | 0acbe05ee2d0e073e52cfe96a9e701dc9891a360 (patch) | |
| tree | ee81381ee8a0c255ca4402f578956feda000db9c | |
| parent | c152449012e21dbf1c3e8bd2081600b9f3858549 (diff) | |
| download | node-new-0acbe05ee2d0e073e52cfe96a9e701dc9891a360.tar.gz | |
http2: allow security revert for Ping/Settings Flood
nghttp2 has updated its limit for outstanding Ping/Settings ACKs
to 1000. This commit allows reverting to the old default of 10000.
The associated CVEs are CVE-2019-9512/CVE-2019-9515.
Backport-PR-URL: https://github.com/nodejs/node/pull/29123
PR-URL: https://github.com/nodejs/node/pull/29122
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
| -rw-r--r-- | src/node_http2.cc | 3 | ||||
| -rw-r--r-- | src/node_revert.h | 1 |
2 files changed, 4 insertions, 0 deletions
diff --git a/src/node_http2.cc b/src/node_http2.cc index 6fa552a315..43d1c2ea9f 100644 --- a/src/node_http2.cc +++ b/src/node_http2.cc @@ -152,6 +152,9 @@ Http2Options::Http2Options(Environment* env, nghttp2_session_type type) { buffer[IDX_OPTIONS_PEER_MAX_CONCURRENT_STREAMS]); } + if (IsReverted(SECURITY_REVERT_CVE_2019_9512)) + nghttp2_option_set_max_outbound_ack(options_, 10000); + // The padding strategy sets the mechanism by which we determine how much // additional frame padding to apply to DATA and HEADERS frames. Currently // this is set on a per-session basis, but eventually we may switch to diff --git a/src/node_revert.h b/src/node_revert.h index 9646588740..8a3d5c0fe4 100644 --- a/src/node_revert.h +++ b/src/node_revert.h @@ -16,6 +16,7 @@ namespace node { #define SECURITY_REVERSIONS(XX) \ + XX(CVE_2019_9512, "CVE-2019-9512", "HTTP/2 Ping/Settings Flood") \ XX(CVE_2019_9514, "CVE-2019-9514", "HTTP/2 Reset Flood") \ XX(CVE_2019_9516, "CVE-2019-9516", "HTTP/2 0-Length Headers Leak") \ XX(CVE_2019_9518, "CVE-2019-9518", "HTTP/2 Empty DATA Frame Flooding") \ |