UBUNTU-CVE-2024-28182

See a problem?

Source

https://ubuntu.com/security/notices/UBUNTU-CVE-2024-28182

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-28182.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2024-28182

Related

Published

2024-04-04T15:15:00Z

Modified

2024-04-04T15:15:00Z

Summary

[none]

Details

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

References

Affected packages

Ubuntu:Pro:16.04:LTS / nghttp2

Package

Name: nghttp2
Purl: pkg:deb/ubuntu/nghttp2@1.7.1-1ubuntu0.1~esm2?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.7.1-1ubuntu0.1~esm2

Affected versions

0.*

0.6.7-1

1.*

1.3.4-2

1.4.0-1

1.4.0-2

1.5.0-2

1.6.0-1

1.7.0-1

1.7.1-1

1.7.1-1ubuntu0.1~esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libnghttp2-14-dbgsym": "1.7.1-1ubuntu0.1~esm2",
            "nghttp2": "1.7.1-1ubuntu0.1~esm2",
            "libnghttp2-14": "1.7.1-1ubuntu0.1~esm2",
            "libnghttp2-dev": "1.7.1-1ubuntu0.1~esm2",
            "nghttp2-client-dbgsym": "1.7.1-1ubuntu0.1~esm2",
            "libnghttp2-doc": "1.7.1-1ubuntu0.1~esm2",
            "nghttp2-proxy": "1.7.1-1ubuntu0.1~esm2",
            "nghttp2-server": "1.7.1-1ubuntu0.1~esm2",
            "nghttp2-client": "1.7.1-1ubuntu0.1~esm2",
            "nghttp2-server-dbgsym": "1.7.1-1ubuntu0.1~esm2",
            "nghttp2-proxy-dbgsym": "1.7.1-1ubuntu0.1~esm2"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / nghttp2

Package

Name: nghttp2
Purl: pkg:deb/ubuntu/nghttp2@1.30.0-1ubuntu1+esm2?arch=src?distro=esm-infra/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.30.0-1ubuntu1+esm2

Affected versions

1.*

1.25.0-1

1.27.0-1

1.28.0-1

1.29.0-1

1.29.0-1build1

1.30.0-1

1.30.0-1ubuntu1

1.30.0-1ubuntu1+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libnghttp2-14-dbgsym": "1.30.0-1ubuntu1+esm2",
            "nghttp2": "1.30.0-1ubuntu1+esm2",
            "libnghttp2-14": "1.30.0-1ubuntu1+esm2",
            "libnghttp2-dev": "1.30.0-1ubuntu1+esm2",
            "nghttp2-client-dbgsym": "1.30.0-1ubuntu1+esm2",
            "libnghttp2-doc": "1.30.0-1ubuntu1+esm2",
            "nghttp2-proxy": "1.30.0-1ubuntu1+esm2",
            "nghttp2-server": "1.30.0-1ubuntu1+esm2",
            "nghttp2-client": "1.30.0-1ubuntu1+esm2",
            "nghttp2-server-dbgsym": "1.30.0-1ubuntu1+esm2",
            "nghttp2-proxy-dbgsym": "1.30.0-1ubuntu1+esm2"
        }
    ]
}

Ubuntu:20.04:LTS / nghttp2

Package

Name: nghttp2
Purl: pkg:deb/ubuntu/nghttp2@1.40.0-1ubuntu0.3?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.40.0-1ubuntu0.3

Affected versions

1.*

1.39.2-1

1.40.0-1

1.40.0-1build1

1.40.0-1ubuntu0.1

1.40.0-1ubuntu0.2

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libnghttp2-14-dbgsym": "1.40.0-1ubuntu0.3",
            "nghttp2": "1.40.0-1ubuntu0.3",
            "libnghttp2-14": "1.40.0-1ubuntu0.3",
            "libnghttp2-dev": "1.40.0-1ubuntu0.3",
            "nghttp2-client-dbgsym": "1.40.0-1ubuntu0.3",
            "libnghttp2-doc": "1.40.0-1ubuntu0.3",
            "nghttp2-proxy": "1.40.0-1ubuntu0.3",
            "nghttp2-server": "1.40.0-1ubuntu0.3",
            "nghttp2-client": "1.40.0-1ubuntu0.3",
            "nghttp2-server-dbgsym": "1.40.0-1ubuntu0.3",
            "nghttp2-proxy-dbgsym": "1.40.0-1ubuntu0.3"
        }
    ]
}

Ubuntu:22.04:LTS / nghttp2

Package

Name: nghttp2
Purl: pkg:deb/ubuntu/nghttp2@1.43.0-1ubuntu0.2?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.43.0-1ubuntu0.2

Affected versions

1.*

1.43.0-1

1.43.0-1build1

1.43.0-1build2

1.43.0-1build3

1.43.0-1ubuntu0.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libnghttp2-14-dbgsym": "1.43.0-1ubuntu0.2",
            "nghttp2": "1.43.0-1ubuntu0.2",
            "libnghttp2-14": "1.43.0-1ubuntu0.2",
            "libnghttp2-dev": "1.43.0-1ubuntu0.2",
            "nghttp2-client-dbgsym": "1.43.0-1ubuntu0.2",
            "libnghttp2-doc": "1.43.0-1ubuntu0.2",
            "nghttp2-proxy": "1.43.0-1ubuntu0.2",
            "nghttp2-server": "1.43.0-1ubuntu0.2",
            "nghttp2-client": "1.43.0-1ubuntu0.2",
            "nghttp2-server-dbgsym": "1.43.0-1ubuntu0.2",
            "nghttp2-proxy-dbgsym": "1.43.0-1ubuntu0.2"
        }
    ]
}

Ubuntu:24.04:LTS / nghttp2

Package

Name: nghttp2
Purl: pkg:deb/ubuntu/nghttp2@1.59.0-1ubuntu0.1?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.59.0-1ubuntu0.1

Affected versions

1.*

1.55.1-1

1.57.0-1

1.58.0-1

1.59.0-1

1.59.0-1build1

1.59.0-1build2

1.59.0-1build4

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libnghttp2-14-dbgsym": "1.59.0-1ubuntu0.1",
            "nghttp2": "1.59.0-1ubuntu0.1",
            "libnghttp2-14": "1.59.0-1ubuntu0.1",
            "libnghttp2-dev": "1.59.0-1ubuntu0.1",
            "nghttp2-client-dbgsym": "1.59.0-1ubuntu0.1",
            "libnghttp2-doc": "1.59.0-1ubuntu0.1",
            "nghttp2-proxy": "1.59.0-1ubuntu0.1",
            "nghttp2-server": "1.59.0-1ubuntu0.1",
            "nghttp2-client": "1.59.0-1ubuntu0.1",
            "nghttp2-server-dbgsym": "1.59.0-1ubuntu0.1",
            "nghttp2-proxy-dbgsym": "1.59.0-1ubuntu0.1"
        }
    ]
}