USN-6754-2

See a problem?

Source

https://ubuntu.com/security/notices/USN-6754-2

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6754-2.json

JSON Data

https://api.osv.dev/v1/vulns/USN-6754-2

Related

Published

2024-05-07T14:44:21.795278Z

Modified

2024-05-07T14:44:21.795278Z

Summary

nghttp2 vulnerability

Details

USN-6754-1 fixed vulnerabilities in nghttp2. This update provides the corresponding update for Ubuntu 24.04 LTS.

Original advisory details:

It was discovered that nghttp2 incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511, CVE-2019-9513)

It was discovered that nghttp2 incorrectly handled request cancellation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)

It was discovered that nghttp2 could be made to process an unlimited number of HTTP/2 CONTINUATION frames. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. (CVE-2024-28182)

References

Affected packages

Ubuntu:24.04:LTS / nghttp2

Package

Name: nghttp2
Purl: pkg:deb/ubuntu/nghttp2@1.59.0-1ubuntu0.1?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.59.0-1ubuntu0.1

Affected versions

1.*

1.55.1-1

1.57.0-1

1.58.0-1

1.59.0-1

1.59.0-1build1

1.59.0-1build2

1.59.0-1build4

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "libnghttp2-14-dbgsym": "1.59.0-1ubuntu0.1",
            "nghttp2": "1.59.0-1ubuntu0.1",
            "libnghttp2-14": "1.59.0-1ubuntu0.1",
            "libnghttp2-dev": "1.59.0-1ubuntu0.1",
            "nghttp2-client-dbgsym": "1.59.0-1ubuntu0.1",
            "libnghttp2-doc": "1.59.0-1ubuntu0.1",
            "nghttp2-proxy": "1.59.0-1ubuntu0.1",
            "nghttp2-server": "1.59.0-1ubuntu0.1",
            "nghttp2-client": "1.59.0-1ubuntu0.1",
            "nghttp2-server-dbgsym": "1.59.0-1ubuntu0.1",
            "nghttp2-proxy-dbgsym": "1.59.0-1ubuntu0.1"
        }
    ]
}