Security Bulletin: IBM Aspera Console has addressed a denial of service vulnerability (CVE-2024-27316)

Summary

IBM Aspera Console is vulnerable to Apache HTTP Server denial of service vulnerability caused by the failure to check or limit the use of HTTP/2 CONTINUATION frames that can be sent within a single stream, a remote attacker could exploit this vulnerability to cause an out of memory (OOM) crash.

Vulnerability Details

CVEID:CVE-2024-27316
**DESCRIPTION:**Apache HTTP Server is vulnerable to a denial of service, caused by the failure to check or limit the use of HTTP/2 CONTINUATION frames that can be sent within a single stream. By sending a stream of CONTINUATION frames that will not be appended to the header list in memory but will still be processed and decoded by the server or will be appended to the header list, a remote attacker could exploit this vulnerability to cause an out of memory (OOM) crash.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/286950 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

It is recommended that customers upgrade to the latest version of IBM Aspera Console:

3.4.2 PL 10

| Windows| click here
IBM Aspera Console|

3.4.2 PL 10

| Linux| click here

Workarounds and Mitigations

None