{"id":114790,"date":"2024-04-04T18:25:42","date_gmt":"2024-04-04T16:25:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0"},"modified":"2024-04-04T18:25:42","modified_gmt":"2024-04-04T16:25:42","slug":"ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","title":{"rendered":"Continuation flood r\u00fcnnak, mis p\u00f5hjustab probleeme HTTP\/2.0 kasutavatel serveritel.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Avalikustati teave \"Continuation flood\" r\u00fcnnakumeetodi kohta, mis puudutab erinevaid HTTP\/2 protokolli realiseerimisi, sealhulgas Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy, oghttp ja nghttp2. Haavatavust saab kasutada r\u00fcnnakute l\u00e4biviimiseks HTTP\/2.0 toetavatele serveritele ja s\u00f5ltuvalt realiseerimisest viib see m\u00e4luhalduse eba\u00f5nnestumiseni (p\u00e4ringute t\u00f6\u00f6tlemise l\u00f5petamine v\u00f5i protsesside j\u00e4rsk l\u00f5ppemine) v\u00f5i suurendab CPU koormust (p\u00e4ringute t\u00f6\u00f6tlemise aeglustumine). Haavatavuse tuvastanud teadlase arvates on tuvastatud probleem ohtlikum kui eelmisel aastal avastatud \"Rapid Reset\" haavatavus, mida kasutati toona suurimate DDoS-r\u00fcnnakute l\u00e4biviimiseks.    <\/p>\n<p>Ohtlikkuse k\u00f5rge tase on seletatav sellega, et s\u00fcsteemi t\u00f6\u00f6 h\u00e4irimiseks <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-los-angeles\/\"   title=\"serverilt\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3609\">serverilt<\/a>, kokkuvarisemiseks v\u00f5i t\u00f5sise j\u00f5udluse languse saavutamiseks piisab \u00fche tavap\u00e4rase arvuti poolt spetsiaalselt koostatud p\u00e4ringute voogude genereerimisest. Teatud juhtudel piisab r\u00fcnnaku teostamiseks isegi \u00fchest TCP-\u00fchendusest. Samal ajal ei eristata r\u00fcnnakuga seotud liiklust logides tavap\u00e4rastest kasutaja p\u00e4ringutest.      <\/p>\n<p>Haavatavus on p\u00f5hjustatud HTTP\/2 protokolli raamide HEADERS ja CONTINUATION t\u00f6\u00f6tlemise erip\u00e4rast. Raame HEADERS kasutatakse HTTP\/2-s HTTP-pealkirjade edastamiseks ning raame CONTINUATION kasutatakse HTTP-pealkirjade saatmise etappideks jagamiseks (nt kui pealkirjad ei mahuks \u00fchte raamidesse v\u00f5i kui alguses tuleb saata pealkirjad, mida saab hetkel t\u00e4ita, ja seej\u00e4rel saata veel pealkirjad, mille v\u00e4\u00e4rtusi ei saa praegu m\u00e4\u00e4rata). Kui pealkirjad saadetakse mitme etapiga, saadetakse alguses raam HEADERS, millel ei ole l\u00f5pp-pealkirja (END_HEADERS) m\u00e4rget, millele j\u00e4rgneb mitu raam CONTINUATION t\u00e4iendavate pealkirjadega ning nimekiri l\u00f5petatakse raamiga CONTINUATION l\u00f5pp-pealkirja m\u00e4rgiga.      <\/p>\n<p>R\u00fcnnakumeetod seisneb t\u00e4iustamata CONTINUATION raamide pidevas saatmises ilma l\u00f5pp-pealkirja (END_HEADERS) m\u00e4rgi m\u00e4\u00e4ramata. Selline tegevus viib edastuseni <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/\"   title=\"server\" data-wpil-keyword-link=\"linked\">server<\/a> suure hulga pealkirjade s\u00e4ilitamine, mida server hoiab m\u00e4lu, kuni protsessile saadaval olev m\u00e4lu on otsa saanud. Suure CPU koormuse tekitamiseks v\u00f5ib r\u00fcndaja lisaks m\u00e4lule ammendumisele kasutada ka CONTINUATION kaadrite sisu kokkusurumist HPACK formaadis, mille anal\u00fc\u00fcsimiseks on vajalikud arvutused. HTTP\/1.1 protokollide rakenduste jaoks kasutati serveri pealkirjade \u00fcleujutuse kaitsmiseks pealkirjatriged ja \u00fchenduse saatmise aja ooteaega. HTTP\/2 puhul, protokolli keerukuse t\u00f5ttu, ei ole paljud rakendused sarnaste meetodite kasutamiseks piiranud l\u00f5pmatute pealkirjade saatmise kaitset.      <\/p>\n<p>Suuremat ohtu kujutab haavatavus Node.js kasutajatele (CVE-2024-27983), kuna see realiseerimine v\u00f5imaldab kokkuvarisemist vaid m\u00f5ne kaadri saatmisega serverisse. Node.js-s esineva v\u00f5istlustingimuse t\u00f5ttu on piisav \u00fchenduste sulgemine ajal, kui saatmine ei ole veel l\u00f5petatud, et saavutada \u00e4kiline l\u00f5pp (kukub kokku, kui sulgemise ajal ei ole veel saabunud CONTINUATION kaader END_HEADERS lipuga). Haavatavus on k\u00f5rvaldatud Node.js versioonides 18.20.1, 21.7.2 ja 20.12.1, samuti uuemates llhttp ja undici teekide v\u00e4ljaannetest. Uutes Node.js versioonides on k\u00f5rvaldatud ka v\u00e4hem ohtlik haavatavus (CVE-2024-27982) \"request smuggling\" klassist, mis v\u00f5imaldab manipuleerimisega \"Content Length\" v\u00e4\u00e4rtusesse sekkuda teiste kasutajate p\u00e4ringute sisu, mis t\u00f6\u00f6deldakse sama l\u00f5ime vahel frontendi ja backend'i vahel.     <\/p>\n<p>Haavatavused, mis on seotud CONTINUATION t\u00f6\u00f6tlemisega, teistes HTTP\/2.0 rakendustes:    <\/p>\n<ul>\n<li class=\"l\"> oghttp (CVE-2024-27919) \u2014 piiramatud m\u00e4lu tarbimine.\n<li class=\"l\"> Tempesta FW (CVE-2024-2758) \u2014 piirangute \u00fcletamine.\n<li class=\"l\"> PHP teek amphp\/http, amphp\/http-client ja amphp\/http-server (CVE-2024-2653) \u2014 piiramatud m\u00e4lu tarbimine, kuni kogu saadaval olev m\u00e4lu on ammendunud.\n<li class=\"l\"> Go pakett net\/http (CVE-2023-45288) \u2014 suur koormus CPU-le.\n<li class=\"l\"> Teek nghttp2 (CVE-2024-28182) \u2014 teenuse katkestamise kutsumine.\n<li class=\"l\"> Apache Httpd (CVE-2024-27316) \u2014 liigne m\u00e4lu tarbimine ja CPU koormuse tekitamine.\n<li class=\"l\"> Apache Traffic Server (CVE-2024-31309) \u2014 liigne ressursside tarbimine.\n<li class=\"l\"> Envoy (CVE-2024-30255) \u2014 suur koormus CPU-le (\u00fche CPU tuuma maksimaalse koormuse jaoks on vajalik 300Mbit\/s voog).  <\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60924\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u043c\u0435\u0442\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 &#171;Continuation flood&#187;, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0441\u0440\u0435\u0434\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy, oghttp \u0438 nghttp2. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0441 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 HTTP\/2.0 \u0438 \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044e \u043f\u0430\u043c\u044f\u0442\u0438 (\u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438\u043b\u0438 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432) \u0438\u043b\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114790","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u043c\u0435\u0442\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 &quot;Continuation flood&quot;, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0441\u0440\u0435\u0434\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy, oghttp \u0438 nghttp2.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 Continuation flood, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 HTTP\/2.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u043c\u0435\u0442\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 &quot;Continuation flood&quot;, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0441\u0440\u0435\u0434\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy, oghttp \u0438 nghttp2.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-04-04T16:25:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-04-04T16:25:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Continuation flood r\u00fcnnak, mis p\u00f5hjustab probleeme serverites, mis kasutavad HTTP\/2.0 | ProHoster","description":"Avalikustatud on teave \"Continuation flood\" r\u00fcnnakumeetodi kohta, mis m\u00f5jutab erinevaid HTTP\/2 protokolli rakendusi, sealhulgas Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy, oghttp ja nghttp2.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 Continuation flood, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 HTTP\/2.0 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u043c\u0435\u0442\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 &quot;Continuation flood&quot;, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0441\u0440\u0435\u0434\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy, oghttp \u0438 nghttp2.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-04T16:25:42+00:00","article:modified_time":"2024-04-04T16:25:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114790","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:41:47","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 21:24:22","updated":"2026-02-22 15:41:47","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=114790"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114790\/revisions"}],"predecessor-version":[{"id":172815,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114790\/revisions\/172815"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=114790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=114790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=114790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}