{"id":37095,"date":"2019-10-31T22:15:43","date_gmt":"2019-10-31T19:15:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej\/"},"modified":"2019-10-31T22:15:43","modified_gmt":"2019-10-31T19:15:43","slug":"v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","title":{"rendered":"V r\u016fzn\u00fdch implementac\u00edch protokolu HTTP\/2 bylo zji\u0161t\u011bno 8 DoS zranitelnost\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>V\u00fdzkumn\u00edci ze spole\u010dnost\u00ed Netflix a Google <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Netflix\/security-bulletins\/blob\/master\/advisories\/third-party\/2019-002.md\">odhalili<\/a><\/noindex>  nalezli v r\u016fzn\u00fdch implementac\u00edch protokolu HTTP\/2 osm zranitelnost\u00ed, kter\u00e9 umo\u017e\u0148uj\u00ed vyvolat odm\u00edtnut\u00ed slu\u017eby t\u00edm, \u017ee se ode\u0161le specificky form\u00e1tovan\u00fd proud s\u00ed\u0165ov\u00fdch po\u017eadavk\u016f. Probl\u00e9my v r\u016fzn\u00e9 m\u00ed\u0159e ovliv\u0148uj\u00ed v\u011bt\u0161inu HTTP server\u016f s podporou HTTP\/2 a vedou k vy\u010derp\u00e1n\u00ed dostupn\u00e9 pracovn\u00ed pam\u011bti nebo vytv\u00e1\u0159ej\u00ed p\u0159\u00edli\u0161 vysok\u00e9 zat\u00ed\u017een\u00ed CPU. Opravy zranitelnost\u00ed ji\u017e byly vyd\u00e1ny v <noindex><a rel=\"nofollow\" href=\"http:\/\/mailman.nginx.org\/pipermail\/nginx-announce\/2019\/000247.html\">nginx 1.16.1\/1.17.3<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"http:\/\/blog.kazuhooku.com\/2019\/08\/h2o-version-226-230-beta2-released.html\">H2O 2.2.6<\/a><\/noindex>, ale zat\u00edm <noindex><a rel=\"nofollow\" href=\"http:\/\/www.apache.org\/dist\/httpd\/\">nedostupn\u00e9<\/a><\/noindex> pro Apache httpd a <noindex><a rel=\"nofollow\" href=\"https:\/\/www.kb.cert.org\/vuls\/id\/605641\/\">dal\u0161\u00ed produkty<\/a><\/noindex>.<\/p>\n<p>Probl\u00e9my byly d\u016fsledkem komplikac\u00ed zaveden\u00fdch do protokolu HTTP\/2, spojen\u00fdch s pou\u017eit\u00edm bin\u00e1rn\u00edch struktur, syst\u00e9mem omezen\u00ed datov\u00fdch proud\u016f v r\u00e1mci spojen\u00ed, mechanismem prioritizace proud\u016f a p\u0159\u00edtomnost\u00ed zpr\u00e1v pro spr\u00e1vu podobn\u00fdch ICMP, kter\u00e9 funguj\u00ed na \u00farovni HTTP\/2 (nap\u0159\u00edklad operace ping, resetov\u00e1n\u00ed a nastaven\u00ed proudu). Mnoh\u00e9 implementace adekv\u00e1tn\u011b neomezovaly tok spr\u00e1vy zpr\u00e1v, neefektivn\u011b organizovaly pr\u00e1ci prioritn\u00edch front p\u0159i zpracov\u00e1n\u00ed po\u017eadavk\u016f nebo pou\u017e\u00edvaly neoptim\u00e1ln\u00ed implementace algoritm\u016f \u0159\u00edzen\u00ed toku.<\/p>\n<p>V\u011bt\u0161ina identifikovan\u00fdch metod \u00fatoku spo\u010d\u00edv\u00e1 v odes\u00edl\u00e1n\u00ed specifick\u00fdch po\u017eadavk\u016f na server, co\u017e vede k generov\u00e1n\u00ed velk\u00e9ho po\u010dtu odpov\u011bd\u00ed. Pokud klient p\u0159itom ne\u010dte data ze socketu a neukon\u010duje spojen\u00ed, fronta vyrovn\u00e1v\u00e1n\u00ed odpov\u011bd\u00ed na stran\u011b serveru se neust\u00e1le pln\u00ed. Takov\u00e9 chov\u00e1n\u00ed vytv\u00e1\u0159\u00ed z\u00e1t\u011b\u017e na syst\u00e9m \u0159\u00edzen\u00ed front zpracov\u00e1n\u00ed s\u00ed\u0165ov\u00fdch spojen\u00ed a v z\u00e1vislosti na specifik\u00e1ch implementace m\u016f\u017ee v\u00e9st k vy\u010derp\u00e1n\u00ed dostupn\u00e9 pam\u011bti nebo zdroj\u016f CPU.<\/p>\n<p>Zji\u0161t\u011bn\u00e9 zranitelnosti:<\/p>\n<ul>\n<li class=\"l\"> CVE-2019-9511 (Data Dribble) \u2014 \u00fato\u010dn\u00edk po\u017eaduje velk\u00e9 mno\u017estv\u00ed dat v n\u011bkolika vl\u00e1knech, manipuluje velikost\u00ed posuvn\u00e9ho okna a prioritou vl\u00e1ken, co\u017e nut\u00ed server um\u00eds\u0165ovat data do fronty v bloc\u00edch po 1 bajtu;\n<li class=\"l\">  CVE-2019-9512 (Ping Flood) \u2014 \u00fato\u010dn\u00edk neust\u00e1le pos\u00edl\u00e1 ping zpr\u00e1vy p\u0159es HTTP\/2 spojen\u00ed, \u010d\u00edm\u017e iniciuje zapl\u0148ov\u00e1n\u00ed vnit\u0159n\u00ed fronty odeslan\u00fdch odpov\u011bd\u00ed na druh\u00e9 stran\u011b;\n<li class=\"l\"> CVE-2019-9513 (Resource Loop) \u2014 \u00fato\u010dn\u00edk vytv\u00e1\u0159\u00ed n\u011bkolik vl\u00e1ken po\u017eadavk\u016f a neust\u00e1le m\u011bn\u00ed priority vl\u00e1ken, co\u017e zp\u016fsobuje prom\u00edch\u00e1n\u00ed prioritn\u00edho stromu;\n<li class=\"l\"> CVE-2019-9514 (Reset Flood) \u2014 \u00fato\u010dn\u00edk vytv\u00e1\u0159\u00ed n\u011bkolik vl\u00e1ken<br \/>\n a odes\u00edl\u00e1 ka\u017ed\u00fd tok neplatn\u00e9ho po\u017eadavku, co\u017e vyvol\u00e1v\u00e1 odesl\u00e1n\u00ed paket\u016f RST_STREAM serverem, ale neakceptuje je pro vypln\u011bn\u00ed fronty odpov\u011bd\u00ed;<\/p>\n<li class=\"l\"> CVE-2019-9515 (Settings Flood) \u2014 \u00fato\u010dn\u00edk pos\u00edl\u00e1 tok pr\u00e1zdn\u00fdch r\u00e1mc\u016f \u201eSETTINGS\u201c, na kter\u00e9 server mus\u00ed potvrdit p\u0159ijet\u00ed ka\u017ed\u00e9ho po\u017eadavku;\n<li class=\"l\">  CVE-2019-9516 (0-Length Headers Leak) \u2014 \u00fato\u010dn\u00edk pos\u00edl\u00e1 tok hlavi\u010dek s nulov\u00fdm n\u00e1zvem a nulovou hodnotou, p\u0159i\u010dem\u017e server vyhrazuje pam\u011b\u0165 pro ka\u017edou hlavi\u010dku a neuvoln\u00ed ji a\u017e do konce relace;\n<li class=\"l\">   CVE-2019-9517 (Internal Data Buffering) \u2014 \u00fato\u010dn\u00edk otev\u00edr\u00e1<br \/>\nklouzav\u00e9 okno HTTP\/2 pro odesl\u00e1n\u00ed dat serverem bez omezen\u00ed, ale p\u0159itom dr\u017e\u00ed okno TCP zav\u0159en\u00e9, co\u017e neumo\u017e\u0148uje skute\u010dn\u011b zapisovat data do soketu. Pot\u00e9 \u00fato\u010dn\u00edk odes\u00edl\u00e1 po\u017eadavky, kter\u00e9 vy\u017eaduj\u00ed velkou odpov\u011b\u010f;<\/p>\n<li class=\"l\"> CVE-2019-9518 (Empty Frames Flood) \u2014 \u00fato\u010dn\u00edk pos\u00edl\u00e1 tok r\u00e1mc\u016f typu DATA, HEADERS, CONTINUATION nebo PUSH_PROMISE, ale s pr\u00e1zdn\u00fdm u\u017eite\u010dn\u00fdm obsahem a bez p\u0159\u00edznaku zakon\u010den\u00ed vl\u00e1ken. Server tr\u00e1v\u00ed \u010das zpracov\u00e1n\u00edm ka\u017ed\u00e9ho r\u00e1mce, co\u017e ne\u00fam\u011brn\u011b odpov\u00edd\u00e1 \u0161\u00ed\u0159ce p\u00e1sma vynalo\u017een\u00e9 \u00fato\u010dn\u00edkem.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Zdroj: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51279\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Netflix \u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0432\u043e\u0441\u0435\u043c\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u0442\u043e\u043a\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u0442\u043e\u0439 \u0438\u043b\u0438 \u0438\u043d\u043e\u0439 \u043c\u0435\u0440\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0441 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 HTTP\/2 \u0438 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u043b\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044e \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37095","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Netflix \u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 8 DoS-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Netflix \u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:15:43+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:15:43+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47V r\u016fzn\u00fdch implementac\u00edch protokolu HTTP\/2 byly nalezeny 8 DoS zranitelnost\u00ed | ProHoster","description":"V\u00fdzkumn\u00edci z firem Netflix a Google odhalili v r\u016fzn\u00fdch implementac\u00edch.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 8 DoS-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Netflix \u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:43+00:00","article:modified_time":"2019-10-31T19:15:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37095","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 06:06:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:22:07","updated":"2026-01-22 06:06:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37095","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=37095"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37095\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=37095"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=37095"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=37095"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}