CVE-2018-16843

Опубликовано: 07 нояб. 2018

Источник: nvd

CVSS3: 5.3

CVSS3: 7.5

CVSS2: 7.8

EPSS Средний

Описание

nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html
Mailing List
Third Party Advisory
http://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html
Mailing List
Vendor Advisory
http://seclists.org/fulldisclosure/2021/Sep/36
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/105868
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1042038
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:3653
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3680
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3681
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16843
Issue Tracking
Third Party Advisory
https://support.apple.com/kb/HT212818
Third Party Advisory
https://usn.ubuntu.com/3812-1/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4335
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html
Mailing List
Third Party Advisory
http://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html
Mailing List
Vendor Advisory
http://seclists.org/fulldisclosure/2021/Sep/36
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/105868
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1042038
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:3653
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3680
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3681
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*

Версия от 1.9.5 (исключая) до 1.14.1 (исключая)

cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*

Версия от 1.15.0 (исключая) до 1.15.6 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Конфигурация 5

cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*

Версия до 13.0 (исключая)

EPSS

Процентиль: 98%

0.55541

Средний

5.3 Medium

CVSS3

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-400

Связанные уязвимости

CVE-2018-16843

CVSS3: 7.5

ubuntu

около 7 лет назад

CVE-2018-16843

CVSS3: 5.3

redhat

больше 7 лет назад

CVE-2018-16843

CVSS3: 7.5

debian

около 7 лет назад

nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the imp ...

GHSA-4p62-4q7w-qmcg

CVSS3: 7.5

github

больше 3 лет назад

BDU:2019-00982

CVSS3: 7.5

fstec

больше 7 лет назад

Уязвимость реализации протокола HTTP/2 сервера nginx, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 98%

0.55541

Средний

5.3 Medium

CVSS3

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-400