It was discovered that nghttp2 incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511, CVE-2019-9513)
It was discovered that nghttp2 incorrectly handled request cancellation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)
It was discovered that nghttp2 could be made to process an unlimited number of HTTP/2 CONTINUATION frames. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. (CVE-2024-28182)
{ "binaries": [ { "binary_name": "libnghttp2-14", "binary_version": "1.7.1-1ubuntu0.1~esm2" }, { "binary_name": "libnghttp2-dev", "binary_version": "1.7.1-1ubuntu0.1~esm2" }, { "binary_name": "nghttp2", "binary_version": "1.7.1-1ubuntu0.1~esm2" }, { "binary_name": "nghttp2-client", "binary_version": "1.7.1-1ubuntu0.1~esm2" }, { "binary_name": "nghttp2-proxy", "binary_version": "1.7.1-1ubuntu0.1~esm2" }, { "binary_name": "nghttp2-server", "binary_version": "1.7.1-1ubuntu0.1~esm2" } ], "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro" }
{ "ecosystem": "Ubuntu:Pro:16.04:LTS", "cves": [ { "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "medium", "type": "Ubuntu" } ], "id": "CVE-2019-9511" }, { "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "medium", "type": "Ubuntu" } ], "id": "CVE-2019-9513" }, { "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "high", "type": "Ubuntu" } ], "id": "CVE-2023-44487" }, { "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "type": "CVSS_V3" }, { "score": "medium", "type": "Ubuntu" } ], "id": "CVE-2024-28182" } ] }
{ "binaries": [ { "binary_name": "libnghttp2-14", "binary_version": "1.30.0-1ubuntu1+esm2" }, { "binary_name": "libnghttp2-dev", "binary_version": "1.30.0-1ubuntu1+esm2" }, { "binary_name": "nghttp2", "binary_version": "1.30.0-1ubuntu1+esm2" }, { "binary_name": "nghttp2-client", "binary_version": "1.30.0-1ubuntu1+esm2" }, { "binary_name": "nghttp2-proxy", "binary_version": "1.30.0-1ubuntu1+esm2" }, { "binary_name": "nghttp2-server", "binary_version": "1.30.0-1ubuntu1+esm2" } ], "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro" }
{ "ecosystem": "Ubuntu:Pro:18.04:LTS", "cves": [ { "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "medium", "type": "Ubuntu" } ], "id": "CVE-2019-9511" }, { "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "medium", "type": "Ubuntu" } ], "id": "CVE-2019-9513" }, { "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "high", "type": "Ubuntu" } ], "id": "CVE-2023-44487" }, { "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "type": "CVSS_V3" }, { "score": "medium", "type": "Ubuntu" } ], "id": "CVE-2024-28182" } ] }
{ "binaries": [ { "binary_name": "libnghttp2-14", "binary_version": "1.40.0-1ubuntu0.3" }, { "binary_name": "libnghttp2-dev", "binary_version": "1.40.0-1ubuntu0.3" }, { "binary_name": "nghttp2", "binary_version": "1.40.0-1ubuntu0.3" }, { "binary_name": "nghttp2-client", "binary_version": "1.40.0-1ubuntu0.3" }, { "binary_name": "nghttp2-proxy", "binary_version": "1.40.0-1ubuntu0.3" }, { "binary_name": "nghttp2-server", "binary_version": "1.40.0-1ubuntu0.3" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "libnghttp2-14", "binary_version": "1.43.0-1ubuntu0.2" }, { "binary_name": "libnghttp2-dev", "binary_version": "1.43.0-1ubuntu0.2" }, { "binary_name": "nghttp2", "binary_version": "1.43.0-1ubuntu0.2" }, { "binary_name": "nghttp2-client", "binary_version": "1.43.0-1ubuntu0.2" }, { "binary_name": "nghttp2-proxy", "binary_version": "1.43.0-1ubuntu0.2" }, { "binary_name": "nghttp2-server", "binary_version": "1.43.0-1ubuntu0.2" } ], "availability": "No subscription required" }