Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apache HTTP Server 2.4.58 (CVE fixes)

downloads.apache.org

Post reply on HN
Print view View original

41–47 of 47 posts

Re: Apache HTTP Server 2.4.58 (CVE fixes)

#41

Post by dang »

teddyh wrote: post #3

Previous discussions: https://news.ycombinator.com/item?id=37830987 > https://news.ycombinator.com/item?id=37830998 > https://news.ycombinator.com/item?id=37831004 >

Thanks! Macroexpanded:

HTTP/2 Rapid Reset: deconstructing the record-breaking attack - https://news.ycombinator.com/item?id=37831004 - Oct 2023 (23 comments)

HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks - https://news.ycombinator.com/item?id=37830998 - Oct 2023 (71 comments)

The novel HTTP/2 'Rapid Reset' DDoS attack - https://news.ycombinator.com/item?id=37830987 - Oct 2023 (106 comments)

Re: Apache HTTP Server 2.4.58 (CVE fixes)

#42

Post by seabrookmx »

nologic01 wrote: post #35

"The early Apache server was a big hit, but we all knew that the codebase needed a general overhaul and redesign." From the README of the apache_1.3.0 distribution (April 1998) https://archive.apache.org/dist/httpd/ Love this project. It changed the world and it still goes strong. The closest to "forever software"?

Up there with gcc and OpenSSH.

Re: Apache HTTP Server 2.4.58 (CVE fixes)

#43

Post by mnot »

supriyo-biswas wrote: post #24
secondcoming wrote: post #17

Is HTTP/2 just too complex for a mere mortal to implement?

No, but QUIC definitely falls in the overly complicated category, spanning multiple, large RFCs. This attack is just about failing to enforce the negotiated parameters during the start phase of the connection.

Wait till you see the TCP RFCs…

Re: Apache HTTP Server 2.4.58 (CVE fixes)

#44

Post by supriyo-biswas »

mnot wrote: post #43
supriyo-biswas wrote: post #24

Earlier quoted context omitted.

No, but QUIC definitely falls in the overly complicated category, spanning multiple, large RFCs. This attack is just about failing to enforce the negotiated parameters during the start phase of the connection.

Wait till you see the TCP RFCs…

I guess it helps that TCP is usually covered to some extent in an undergrad course, and also that it's unencrypted.

Re: Apache HTTP Server 2.4.58 (CVE fixes)

#46

Post by pornel »

nijave wrote: post #20
secondcoming wrote: post #17

Is HTTP/2 just too complex for a mere mortal to implement?

I don't think this has too much to do with the spec and more about discovering and preventing DoS vectors.

Also HAProxy managed to predict and mitigate this issue 5 years ago.
Post reply on HN