Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2019:2473-1

Опубликовано: 26 сент. 2019
Источник: suse-cvrf

Описание

Security update for nghttp2

This update for nghttp2 fixes the following issues:

Security issues fixed:

  • CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184).
  • CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#11461).

Bug fixes and enhancements:

  • Fixed mistake in spec file (bsc#1125689)
  • Fixed build issue with boost 1.70.0 (bsc#1134616)
  • Feature: Add W&S module (FATE#326776, bsc#1112438)

Список пакетов

Container ses/6/cephcsi/cephcsi:latest
libnghttp2-14-1.39.2-3.3.1
Container ses/6/rook/ceph:latest
libnghttp2-14-1.39.2-3.3.1
Container suse/sle15:15.0
libnghttp2-14-1.39.2-3.3.1
Container suse/sle15:15.1
libnghttp2-14-1.39.2-3.3.1
Image SLES15-Azure-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-EC2-CHOST-HVM-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-EC2-HVM-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-GCE-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-OCI-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SAP-Azure
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SAP-Azure-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SAP-Azure-LI-BYOS-Production
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SAP-Azure-VLI-BYOS-Production
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SAP-EC2-HVM
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SAP-EC2-HVM-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SAP-GCE
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SAP-GCE-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SAP-OCI-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-Azure-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-Azure-HPC-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-CAP-Deployment-BYOS-EC2-HVM
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-CAP-Deployment-BYOS-GCE
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-CHOST-BYOS-Azure
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-CHOST-BYOS-EC2
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-CHOST-BYOS-GCE
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-EC2-HPC-HVM-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-EC2-HVM-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-GCE-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-Manager-4-0-Azure-BYOS-Proxy
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Proxy
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-Manager-4-0-GCE-BYOS-Proxy
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-OCI-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-SAP-Azure
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-SAP-Azure-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-SAP-Azure-LI-BYOS-Production
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-SAP-EC2-HVM
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-SAP-EC2-HVM-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-SAP-GCE
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-SAP-GCE-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-SAP-OCI-BYOS
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-SAPCAL-Azure
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-SAPCAL-EC2-HVM
libnghttp2-14-1.39.2-3.3.1
Image SLES15-SP1-SAPCAL-GCE
libnghttp2-14-1.39.2-3.3.1
SUSE Linux Enterprise Module for Basesystem 15
libnghttp2-14-1.39.2-3.3.1
libnghttp2-14-32bit-1.39.2-3.3.1
libnghttp2-devel-1.39.2-3.3.1
libnghttp2_asio-devel-1.39.2-3.3.1
libnghttp2_asio1-1.39.2-3.3.1
SUSE Linux Enterprise Module for Basesystem 15 SP1
libnghttp2-14-1.39.2-3.3.1
libnghttp2-14-32bit-1.39.2-3.3.1
libnghttp2-devel-1.39.2-3.3.1
libnghttp2_asio-devel-1.39.2-3.3.1
libnghttp2_asio1-1.39.2-3.3.1

Ссылки

Описание

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Затронутые продукты
Container ses/6/cephcsi/cephcsi:latest:libnghttp2-14-1.39.2-3.3.1
Container ses/6/rook/ceph:latest:libnghttp2-14-1.39.2-3.3.1
Container suse/sle15:15.0:libnghttp2-14-1.39.2-3.3.1
Container suse/sle15:15.1:libnghttp2-14-1.39.2-3.3.1
Ссылки

Описание

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.

Затронутые продукты
Container ses/6/cephcsi/cephcsi:latest:libnghttp2-14-1.39.2-3.3.1
Container ses/6/rook/ceph:latest:libnghttp2-14-1.39.2-3.3.1
Container suse/sle15:15.0:libnghttp2-14-1.39.2-3.3.1
Container suse/sle15:15.1:libnghttp2-14-1.39.2-3.3.1
Ссылки
Уязвимость SUSE-SU-2019:2473-1