nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).

An update of the cmake package has been released.

This update for nghttp2 fixes the following issues :

Security issues fixed :

CVE-2020-11080: HTTP/2 Large Settings Frame DoS (bsc#1181358).

CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184).

CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146182).

CVE-2018-1000168: Fixed ALTSVC frame client side denial of service (bsc#1088639).

CVE-2016-1544: Fixed out of memory due to unlimited incoming HTTP header fields (bsc#966514).

Bug fixes and enhancements :

Packages must not mark license files as %doc (bsc#1082318)

Typo in description of libnghttp2_asio1 (bsc#962914)

Fixed mistake in spec file (bsc#1125689)

Fixed build issue with boost 1.70.0 (bsc#1134616)

Fixed build issue with GCC 6 (bsc#964140)

Feature: Add W&S module (FATE#326776, bsc#1112438)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201612-13 (nghttp2: Denial of Service)

    Nghttpd, nghttp, and libnghttp2_asio applications do not limit the       memory usage for the incoming HTTP header field. If a peer sends a       specially crafted HTTP/2 HEADERS frame and CONTINUATION frame, they will       crash with an out of memory error.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for nghttp2 fixes the following vulnerabilities :

  - CVE-2016-1544: A malicious remote attacker could have     caused an Out of memory condition due to unlimited     incoming HTTP header fields (boo#966514)

CVE-2016-1544: Out of memory in nghttpd, nghttp, and libnghttp2_asio applications due to unlimited incoming HTTP header fields:
https://github.com/tatsuhiro-t/nghttp2/releases/tag/v1.7.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Nghttp2 reports :

Out of memory in nghttpd, nghttp, and libnghttp2_asio applications due to unlimited incoming HTTP header fields.

nghttpd, nghttp, and libnghttp2_asio applications do not limit the memory usage for the incoming HTTP header field. If peer sends specially crafted HTTP/2 HEADERS frames and CONTINUATION frames, they will crash with out of memory error.

Note that libnghttp2 itself is not affected by this vulnerability.

ID	Name	Product	Family	Severity
204588	Photon OS 4.0: Cmake PHSA-2023-4.0-0420	Nessus	PhotonOS Local Security Checks	critical
148164	SUSE SLES12 Security Update : nghttp2 (SUSE-SU-2021:0932-1) (Data Dribble) (Resource Loop)	Nessus	SuSE Local Security Checks	high
95528	GLSA-201612-13 : nghttp2: Denial of Service	Nessus	Gentoo Local Security Checks	low
89812	openSUSE Security Update : nghttp2 (openSUSE-2016-314)	Nessus	SuSE Local Security Checks	low
89593	Fedora 23 : nghttp2-1.7.1-1.fc23 (2016-ac861a840e)	Nessus	Fedora Local Security Checks	high
89521	Fedora 22 : nghttp2-1.7.1-1.fc22 (2016-3d9efe44d8)	Nessus	Fedora Local Security Checks	high
88729	FreeBSD : nghttp2 -- Out of memory in nghttpd, nghttp, and libnghttp2_asio (07718e2b-d29d-11e5-a95f-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	low

Detections

Analytics

CVE-2016-1544

low

Tenable Plugins

critical

high

low

low

high

high

low