It was discovered that nghttp2 incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511, CVE-2019-9513)
It was discovered that nghttp2 incorrectly handled request cancellation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)
It was discovered that nghttp2 could be made to process an unlimited number of HTTP/2 CONTINUATION frames. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. (CVE-2024-28182)
{
"binaries": [
{
"binary_name": "libnghttp2-14",
"binary_version": "1.7.1-1ubuntu0.1~esm2"
},
{
"binary_name": "libnghttp2-dev",
"binary_version": "1.7.1-1ubuntu0.1~esm2"
},
{
"binary_name": "nghttp2",
"binary_version": "1.7.1-1ubuntu0.1~esm2"
},
{
"binary_name": "nghttp2-client",
"binary_version": "1.7.1-1ubuntu0.1~esm2"
},
{
"binary_name": "nghttp2-proxy",
"binary_version": "1.7.1-1ubuntu0.1~esm2"
},
{
"binary_name": "nghttp2-server",
"binary_version": "1.7.1-1ubuntu0.1~esm2"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
{
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"cves": [
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2019-9511"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2019-9513"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "high",
"type": "Ubuntu"
}
],
"id": "CVE-2023-44487"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2024-28182"
}
]
}
{
"binaries": [
{
"binary_name": "libnghttp2-14",
"binary_version": "1.30.0-1ubuntu1+esm2"
},
{
"binary_name": "libnghttp2-dev",
"binary_version": "1.30.0-1ubuntu1+esm2"
},
{
"binary_name": "nghttp2",
"binary_version": "1.30.0-1ubuntu1+esm2"
},
{
"binary_name": "nghttp2-client",
"binary_version": "1.30.0-1ubuntu1+esm2"
},
{
"binary_name": "nghttp2-proxy",
"binary_version": "1.30.0-1ubuntu1+esm2"
},
{
"binary_name": "nghttp2-server",
"binary_version": "1.30.0-1ubuntu1+esm2"
}
],
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
}
{
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"cves": [
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2019-9511"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2019-9513"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "high",
"type": "Ubuntu"
}
],
"id": "CVE-2023-44487"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2024-28182"
}
]
}
{
"binaries": [
{
"binary_name": "libnghttp2-14",
"binary_version": "1.40.0-1ubuntu0.3"
},
{
"binary_name": "libnghttp2-dev",
"binary_version": "1.40.0-1ubuntu0.3"
},
{
"binary_name": "nghttp2",
"binary_version": "1.40.0-1ubuntu0.3"
},
{
"binary_name": "nghttp2-client",
"binary_version": "1.40.0-1ubuntu0.3"
},
{
"binary_name": "nghttp2-proxy",
"binary_version": "1.40.0-1ubuntu0.3"
},
{
"binary_name": "nghttp2-server",
"binary_version": "1.40.0-1ubuntu0.3"
}
],
"availability": "No subscription required"
}
{
"binaries": [
{
"binary_name": "libnghttp2-14",
"binary_version": "1.43.0-1ubuntu0.2"
},
{
"binary_name": "libnghttp2-dev",
"binary_version": "1.43.0-1ubuntu0.2"
},
{
"binary_name": "nghttp2",
"binary_version": "1.43.0-1ubuntu0.2"
},
{
"binary_name": "nghttp2-client",
"binary_version": "1.43.0-1ubuntu0.2"
},
{
"binary_name": "nghttp2-proxy",
"binary_version": "1.43.0-1ubuntu0.2"
},
{
"binary_name": "nghttp2-server",
"binary_version": "1.43.0-1ubuntu0.2"
}
],
"availability": "No subscription required"
}