nginx/tengine HTT2/Bomb
Published 2 months ago
Published 2 months ago
Tschubaka
Updated 2 months ago
0
There is a DOS vulnerability in nginx/tengine https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb. In nginx, the vulnerability was fixed in version 1.29.8 and later. In Tengine, it was fixed in 3.2-dev https://github.com/alibaba/tengine/pull/2040. For now, I have temporarily disabled HTTP/2 under Application/Advanced Config. Is there already a schedule for an update to SafeLine/Tengine?
Tschubaka
Updated 2 months ago
0
nginx/tengine HTTP2/Bomb
Carrie
Updated 2 months ago
0
Thank you!
weāre already aware of this issue. Please keep HTTP/2 disabled.
We plan to fix this in the upcoming release scheduled for June.
When thereās an important new release that we recommend upgrading to, Iāll notify everyone here: https://discord.com/channels/1243085666485534830/1263759967429857372
Peter Larin
Updated a month ago
0
Can you let me know how to enable/disable HTTP/2 in the advanced config?
Carrie
Updated a month ago
Peter Larin
Updated a month ago
0
Thank you Carrie, I found it! However it seems to be a global setting, not per app?
Carrie
Updated a month ago
Yes, since HTTP/2 is a transportālevel feature that is negotiated on the listening port (for example, 443), not on a single application.
Once HTTP/2 is enabled on a port, all applications on that port share the same capability. To keep behavior consistent and avoid unexpected issues, we only provide HTTP/2 as a global/portālevel setting instead of perāapplication switches.