H2Dos CVE - has Phoenix’s HTTP/2 support has been tested against the new H2DOS security bulletins?

ityonemo · September 4, 2019, 3:16pm

Does anyone know if Phoenix’s HTTP/2 support has been tested against the new H2DOS security bulletins?

Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

# Advisory
###### ID: NFLX-2019-002

###### Title: HTTP/2 Denial of Service Advisory

###### Release Date: 2019-08-13

###### Severity: High

### Overview:

Netflix has discovered several resource exhaustion vectors affecting a
variety of third-party HTTP/2 implementations. These attack vectors
can be used to launch DoS attacks against servers that support HTTP/2
communication.

Netflix worked with Google and
[CERT/CC](https://www.sei.cmu.edu/about/divisions/cert/) to coordinate
disclosure to the Internet community.

This file has been truncated. show original

hauleth · September 4, 2019, 4:40pm

It do not have anything to do with Phoenix nor Plug, this needs to be done in HTTP server implementation. And as the only one officially supported HTTP server by Plug is Cowboy, you should follow it on the Cowboy’s issue tracker.

ityonemo · September 4, 2019, 5:16pm

thanks for the linkout!