Alerts This Week
Warning Icon 1 923
Alerts This Week
Warning Icon 1 923

Fedora 38: FEDORA-2023-f75af676f2 Critical: llhttp Remote Code Execution

fedora
Calendar Grey August 7, 2023
Dist Fedora Esm H88
To secure your Fedora 38 environment against CVE-2023-30589, follow these steps: update packages, install llhttp and python-aiohttp, check versions, reboot if needed, and audit for security.
Update `llhttp` to 8.1.1 and `python-aiohttp` to 3.8.5

Summary

This project is a port of http_parser to TypeScript. llparse is used to

generate the output C source file, which could be compiled and linked with the

embedder's program (like Node.js).

This copy of the library is compiled with LLHTTP_STRICT_MODE set to 0

(disabled), which is the default.

Update Information:

Update `llhttp` to 8.1.1 and `python-aiohttp` to 3.8.5. Fixes CVE-2023-30589.

Topics%20covered

Topics Covered

security advisory critical Fedora remote code execution python-aiohttp llhttp CVE-2023-30589

Change Log

* Sat Jul 29 2023 Benjamin A. Beasley - 8.1.1-1 - Update to 8.1.1 (close RHBZ#2216591) * Thu Jul 20 2023 Fedora Release Engineering - 8.1.0-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Sat Jun 3 2023 Benjamin A. Beasley - 8.1.0-5 - Remove explicit %set_build_flags, not needed since F36

References


[ 1 ] Bug #2216591 - llhttp-8.1.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2216591 [ 2 ] Bug #2227458 - python-aiohttp-3.8.5 is available https://bugzilla.redhat.com/show_bug.cgi?id=2227458

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-f75af676f2' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html

Severity
critical
Lowest
Low
Medium
High
Critical

Name: llhttp
Product: Fedora 38
Version: 8.1.1
Release: 1.fc38
URL: https://github.com/nodejs/llhttp
Summary: Port of http_parser to llparse

Topics%20covered

Topics Covered

security advisory critical Fedora remote code execution python-aiohttp llhttp CVE-2023-30589

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here