CVE-2024-4109

What it actually does

An HTTP request header value from a previous stream may be incorrectly reused for a request associated with a subsequent stream on the same HTTP/2 connection, enabling information leakage between requests.

Why it matters to the business

Organizations may inadvertently expose sensitive request data such as authentication tokens or user details across different sessions or users sharing the same connection, increasing risk of data breaches and compliance violations.

How an attack unfolds

An attacker establishes a persistent HTTP/2 connection and sends sequential requests crafted to trigger header reuse from prior streams, allowing capture of leaked header values containing sensitive information from other requests.

How to fix it

Upgrade affected packages to the specified fixed versions: libpam-radius-auth on Ubuntu Pro 14.04 LTS to 1.3.17-0ubuntu4+esm1, on Ubuntu 16.04 LTS to 1.3.17-0ubuntu4.1, and on Ubuntu 18.04 LTS to 1.3.17-0ubuntu5.18.04.1. Apply updates immediately given the information disclosure nature.

How to confirm the fix worked

Verify package versions match the fixed releases listed for each Ubuntu distribution, review HTTP/2 connection handling in updated code for proper stream isolation, and test with multiple concurrent requests to confirm no cross-stream header leakage occurs.

Typical attack path

1. Establish long-lived HTTP/2 connection to the vulnerable server
2. Issue multiple sequential requests on the shared connection
3. Trigger conditions that cause header value reuse across streams
4. Capture or observe leaked header data from previous requests

How to detect it

Inspect server access logs for patterns of repeated requests on long-lived HTTP/2 connections and correlate with any anomalous header values appearing across unrelated sessions; review application logs for unexpected header reuse indicators.

What your security team should do

• Prioritize patching all listed Ubuntu versions of the affected package within the next maintenance window
• Monitor for any public exploit code given the published date and information disclosure impact
• Review HTTP/2 proxy and load balancer configurations for similar header handling issues