PT-2024-2591 · Unknown · Amphp/Http+1

Bartekn · Published 2024-01-05 · Updated 2024-09-06 · CVE-2024-2653

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions amphp/http versions prior to the fixed version amphp/http-client versions 4.0.0-rc10 through 4.0.0

Description The issue is related to the amphp/http library and its HTTP/2 protocol implementation, specifically with uncontrolled memory allocation due to incorrect size limits when handling CONTINUATION frames. This can result in an out-of-memory (OOM) crash. The vulnerability can be exploited by a remote attacker to cause a denial of service by sending HTTP packets.

Recommendations For amphp/http versions prior to the fixed version, update to a version that includes the fix for this issue. For amphp/http-client versions 4.0.0-rc10 through 4.0.0, update to a version that includes the fix for this issue or later. As a temporary workaround, consider restricting the use of the HTTP/2 protocol or limiting the size of incoming HTTP packets to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-789

CWE-770

Related Identifiers

BDU:2024-02654

CVE-2024-2653

GHSA-QJFW-CVJF-F4FM

GHSA-W8GF-G2VQ-J2F4

Affected Products

Amphp/Http

Amphp/Http-Client

References · 24

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/amphp/http-client/CVE-2024-2653.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/amphp/http/CVE-2024-2653.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-2653 · Security Note
• https://osv.dev/vulnerability/GHSA-qjfw-cvjf-f4fm · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w8gf-g2vq-j2f4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-2653 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02654 · Security Note
• https://github.com/amphp/http-client/security/advisories/GHSA-w8gf-g2vq-j2f4 · Note
• https://github.com/amphp/http-client · Note
• https://github.com/amphp/http/security/advisories/GHSA-qjfw-cvjf-f4fm · Note
• https://github.com/amphp/http · Note
• https://github.com/amphp/http/commit/881cc33da236fbcd0cb0cf6c2bfc7efcf80ede76 · Note
• https://github.com/amphp/http/commit/3a33e68a3b53f7279217238e89748cf0cb30b8a6 · Note
• https://t.me/echeloneyes/2638 · Telegram Post
• https://t.me/cvenotify/75657 · Telegram Post