A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. This attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header table into the dynamic header table. The attacker can then send a header block that is simply repeated requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4,096 or better, meaning that 16kB of data can decompress to 64MB of data on the target machine.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0     could be targeted for a denial of service attack, specifically a so-called HPACK Bomb attack. This     attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header     table into the dynamic header table. The attacker can then send a header block that is simply repeated     requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4,096     or better, meaning that 16kB of data can decompress to 64MB of data on the target machine. (CVE-2016-6581)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0
    could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. This
    attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header
    table into the dynamic header table. The attacker can then send a header block that is simply repeated
    requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4,096
    or better, meaning that 16kB of data can decompress to 64MB of data on the target machine. (CVE-2016-6581)

ID	Name	Product	Family	Type	Severity
253894	Linux Distros Unpatched Vulnerability : CVE-2016-6581	Nessus	Misc.	Local	high
423457	SCA: security update for hpack (GHSA-ffq8-576r-v26g)	Tenable Cloud Security	SCA Checks	Local	high
423457	SCA: security update for hpack (GHSA-ffq8-576r-v26g)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2016-6581

high

Tenable Plugins

high

high

high