Allocation of Resources Without Limits or Throttling in hyper - CVE-2022-31394

Vulnerability identifier: #VU75144

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-31394

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform DoS attack.

The vulnerability exists due to the library does not allow customization of the max_header_list_size method in the H2 third-party software. A remote attacker can send overly large requests to the application and perform a denial of service (DoS) attack.

hyper
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP3 LTSS
Development Tools Module
Public Cloud Module
Desktop Applications Module
openSUSE Leap
sccache
sccache-debuginfo
gstreamer-plugins-rs
gstreamer-plugins-rs-debugsource
gstreamer-plugins-rs-devel
gstreamer-plugins-rs-debuginfo
aws-nitro-enclaves-cli
aws-nitro-enclaves-cli-debuginfo
aws-nitro-enclaves-binaryblobs-upstream-debuginfo
aws-nitro-enclaves-cli-debugsource
system-group-ne
aws-nitro-enclaves-binaryblobs-upstream
rustup-debuginfo
rustup-debugsource
rustup

Install updates from vendor's website.

hyper - update to 0.14.19
sccache - addressed in versions 0.4.1~18-150300.7.12.1, 0.4.2~3-150400.3.3.1
sccache-debuginfo - addressed in versions 0.4.1~18-150300.7.12.1, 0.4.2~3-150400.3.3.1
gstreamer-plugins-rs - update to 0.8.2-150400.3.3.1
gstreamer-plugins-rs-debugsource - update to 0.8.2-150400.3.3.1
gstreamer-plugins-rs-devel - update to 0.8.2-150400.3.3.1
gstreamer-plugins-rs-debuginfo - update to 0.8.2-150400.3.3.1
aws-nitro-enclaves-cli - update to 1.2.2-0
aws-nitro-enclaves-cli-debuginfo - update to 1.2.2~git0.4ccc639-150400.3.3.1
aws-nitro-enclaves-binaryblobs-upstream-debuginfo - update to 1.2.2~git0.4ccc639-150400.3.3.1
aws-nitro-enclaves-cli-debugsource - update to 1.2.2~git0.4ccc639-150400.3.3.1
system-group-ne - update to 1.2.2~git0.4ccc639-150400.3.3.1
aws-nitro-enclaves-cli - update to 1.2.2~git0.4ccc639-150400.3.3.1
aws-nitro-enclaves-binaryblobs-upstream - update to 1.2.2~git0.4ccc639-150400.3.3.1
rustup-debuginfo - update to 1.26.0~0-150400.3.7.1
rustup-debugsource - update to 1.26.0~0-150400.3.7.1
rustup - update to 1.26.0~0-150400.3.7.1

• https://github.com/hyperium/hyper/issues/2826
• https://github.com/hyperium/hyper/compare/v0.14.18...v0.14.19
• https://github.com/hyperium/hyper/pull/2828

• Denial of service in Hyperium Hyper
• SUSE update for aws-nitro-enclaves-cli
• SUSE update for rustup
• SUSE update for sccache
• SUSE update for gstreamer-plugins-rs
• SUSE update for sccache
• Amazon Linux AMI update for aws-nitro-enclaves-cli