Description
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Enterprise Linux 10
Default version status: affected
0:3.6.5-3.el10_2.14 to < *unaffected
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
Default version status: affected
0:3.6.5-3.el10_0.18 to < *unaffected
Red Hat Red Hat Enterprise Linux 6
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 7
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 8
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 9
Default version status: unaffected