A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious peer by having that peer assign priority information for every possible HTTP/2 stream ID. The priority tree would happily continue to store the priority information for each stream, and would therefore allocate unbounded amounts of memory. Attempting to actually use a tree like this would also cause extremely high CPU usage to maintain the tree.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/92311 | Third Party Advisory VDB Entry |
| https://python-hyper.org/priority/en/latest/security/CVE-2016-6580.html | Mitigation Vendor Advisory |
| http://www.securityfocus.com/bid/92311 | Third Party Advisory VDB Entry |
| https://python-hyper.org/priority/en/latest/security/CVE-2016-6580.html | Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 02:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/92311 - Third Party Advisory, VDB Entry | |
| References | () https://python-hyper.org/priority/en/latest/security/CVE-2016-6580.html - Mitigation, Vendor Advisory |
Information
Published : 2017-01-10 15:59
Updated : 2024-11-21 02:56
NVD link : CVE-2016-6580
Mitre link : CVE-2016-6580
CVE.ORG link : CVE-2016-6580
JSON object : View
Products Affected
python
- python_priority_library
CWE
CWE-399
Resource Management Errors