Pages

[Gregg]

Well it didn't take long.

This time around however I updated nghttp2 to the latest 1.15.0 (was 1.12.0).
You will need to decide if you want to update or not if you are not using CRLs in your SSL configuration. Here's the announcement from OpenSSL.

Missing CRL sanity check (CVE-2016-7052)
========================================

Severity: Moderate

This issue only affects OpenSSL 1.0.2i, released on 22nd September 2016.

A bug fix which included a CRL sanity check was added to OpenSSL 1.1.0
but was omitted from OpenSSL 1.0.2i. As a result any attempt to use
CRLs in OpenSSL 1.0.2i will crash with a null pointer exception.

OpenSSL 1.0.2i users should upgrade to 1.0.2j

The issue was reported to OpenSSL on 22nd September 2016 by Bruce Stephens and
Thomas Jakobi. The fix was developed by Matt Caswell of the OpenSSL development
team.

So there it is and is all there is.

Those few users on 2.4.23 VC11 who have downgraded to OpenSSL 1.0.1u last time need to do nothing as this bug does not affect 1.0.1. You may wish to update the http2 modules and nghttp2.dll in the /bin directory however, it's up to you.