{"action":"created","issue":{"url":"https://api.github.com/repos/h2o/h2o/issues/1144","repository_url":"https://api.github.com/repos/h2o/h2o","labels_url":"https://api.github.com/repos/h2o/h2o/issues/1144/labels{/name}","comments_url":"https://api.github.com/repos/h2o/h2o/issues/1144/comments","events_url":"https://api.github.com/repos/h2o/h2o/issues/1144/events","html_url":"https://github.com/h2o/h2o/issues/1144","id":196594690,"number":1144,"title":"Use-after-free vulnerability (CVE-2016-7835)","user":{"login":"kazuho","id":41567,"avatar_url":"https://avatars.githubusercontent.com/u/41567?v=3","gravatar_id":"","url":"https://api.github.com/users/kazuho","html_url":"https://github.com/kazuho","followers_url":"https://api.github.com/users/kazuho/followers","following_url":"https://api.github.com/users/kazuho/following{/other_user}","gists_url":"https://api.github.com/users/kazuho/gists{/gist_id}","starred_url":"https://api.github.com/users/kazuho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kazuho/subscriptions","organizations_url":"https://api.github.com/users/kazuho/orgs","repos_url":"https://api.github.com/users/kazuho/repos","events_url":"https://api.github.com/users/kazuho/events{/privacy}","received_events_url":"https://api.github.com/users/kazuho/received_events","type":"User","site_admin":false},"labels":[{"id":382670965,"url":"https://api.github.com/repos/h2o/h2o/labels/vulnerability","name":"vulnerability","color":"bfd4f2","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-12-20T06:16:27Z","updated_at":"2016-12-21T07:32:10Z","closed_at":null,"body":"A use-after-free vulnerability exists in H2O upto and including version 2.0.4 / 2.1.0-beta3 that can be used to by an remote attacker to mount DoS attacks and / or information theft[1].\r\n\r\nUsers using H2O version 2.0.x for serving plaintext HTTP (i.e. non-HTTPS) requests are advised to upgrade immediately to [version 2.0.5](https://github.com/h2o/h2o/releases/v2.0.5). Users of 2.1-beta series are advised to upgrade to [2.1.0-beta4](https://github.com/h2o/h2o/releases/v2.1.0-beta4) regardless of their configuration.\r\n\r\n\r\n1: possible leakage includes the TLS private keys for deployments that have explicitly turned off [neverbleed](https://h2o.examp1e.net/configure/base_directives.html#neverbleed). Default is _on_ meaning that the private keys are protected within a separate process."},"comment":{"url":"https://api.github.com/repos/h2o/h2o/issues/comments/268455825","html_url":"https://github.com/h2o/h2o/issues/1144#issuecomment-268455825","issue_url":"https://api.github.com/repos/h2o/h2o/issues/1144","id":268455825,"user":{"login":"tatsushid","id":5148885,"avatar_url":"https://avatars.githubusercontent.com/u/5148885?v=3","gravatar_id":"","url":"https://api.github.com/users/tatsushid","html_url":"https://github.com/tatsushid","followers_url":"https://api.github.com/users/tatsushid/followers","following_url":"https://api.github.com/users/tatsushid/following{/other_user}","gists_url":"https://api.github.com/users/tatsushid/gists{/gist_id}","starred_url":"https://api.github.com/users/tatsushid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tatsushid/subscriptions","organizations_url":"https://api.github.com/users/tatsushid/orgs","repos_url":"https://api.github.com/users/tatsushid/repos","events_url":"https://api.github.com/users/tatsushid/events{/privacy}","received_events_url":"https://api.github.com/users/tatsushid/received_events","type":"User","site_admin":false},"created_at":"2016-12-21T07:32:10Z","updated_at":"2016-12-21T07:32:10Z","body":"I've updated following binary package builder repositories too\r\n\r\n- https://github.com/tatsushid/h2o-rpm\r\n- https://github.com/tatsushid/h2o-deb\r\n\r\nIt is highly recommended that anyone who uses the above upgrades them.\r\n\r\n**Note:** Deb package builder works on my local but has something problem on Travis building so prebuilt packages have not been released. It will be fixed and released later."}}
{"actor":{"display_login":"tatsushid"}}