#1101131 icecast2: DoS vector using incorrect TLS teardown

Package:
icecast2
Source:
icecast2
Description:
streaming media server
Submitter:
Nicolas Peugnet
Date:
2025-11-17 20:47:01 UTC
Severity:
normal
Tags:
#1101131#5
Date:
2025-03-23 15:14:39 UTC
From:
To:
Dear Maintainer,

Icecast2 in Debian is affected by this upstream issue with TLS
connections (https://gitlab.xiph.org/xiph/icecast-server/-/issues/2355):

This has been visibly patched in upstream's VCS, in a 2.4.5 branch that
looks like it has not been released yet:
https://gitlab.xiph.org/xiph/icecast-server/-/commit/8662884447efc414e885b20b965f465d37a01fb5

I applied this patch by simply dowloading the txt version from GitLab:
https://gitlab.xiph.org/xiph/icecast-server/-/commit/8662884447efc414e885b20b965f465d37a01fb5.patch

I am currently running a patched version of icecast2 and the problems
seems to be fixed.

A reliable way to reproduce the issue is to enable TLS, create a stream
with BUTT and have at least one listener (e.g. with firefox), then click
the stop button of BUTT. This make icecast use 100% of a CPU while
beeing in a waiting state.

The bug did not happen back yet with the patched version.

Could you please add this patch to the patch series?

#1101131#10
Date:
2025-03-26 13:32:08 UTC
From:
To:
CCing both Uploaders in case they are not subscribed to the list of the
"Maintainer" field.

It would be good if this simple patch could be included before Trixie is
released.

#1101131#15
Date:
2025-11-17 20:44:58 UTC
From:
To:
Dear maintainers,

I opened a Merge Request against the icecast repository to add the patch
that Nicolas Peugnet suggested:
https://salsa.debian.org/multimedia-team/icecast2/-/merge_requests/6

Could one of you please have a look?


Thanks

Jonas