csaf_redhat - rhsa-2020

rhsa-2020_2850

Vulnerability from csaf_redhat

Published

2020-07-07 09:03

Modified

2024-11-15 08:32

Summary

Red Hat Security Advisory: nghttp2 security update

Notes

Topic

An update for nghttp2 is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for nghttp2 is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.\n\nSecurity Fix(es):\n\n* nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2020:2850",
        "url": "https://access.redhat.com/errata/RHSA-2020:2850"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1844929",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1844929"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2850.json"
      }
    ],
    "title": "Red Hat Security Advisory: nghttp2 security update",
    "tracking": {
      "current_release_date": "2024-11-15T08:32:32+00:00",
      "generator": {
        "date": "2024-11-15T08:32:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2020:2850",
      "initial_release_date": "2020-07-07T09:03:09+00:00",
      "revision_history": [
        {
          "date": "2020-07-07T09:03:09+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2020-07-07T09:03:09+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T08:32:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS E4S (v. 8.0)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS E4S (v. 8.0)",
                  "product_id": "BaseOS-8.0.0.Z.E4S",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_e4s:8.0::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-1.el8_0.2.i686",
                "product": {
                  "name": "libnghttp2-0:1.33.0-1.el8_0.2.i686",
                  "product_id": "libnghttp2-0:1.33.0-1.el8_0.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-1.el8_0.2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-1.el8_0.2.i686",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-1.el8_0.2.i686",
                  "product_id": "nghttp2-debugsource-0:1.33.0-1.el8_0.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-1.el8_0.2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-1.el8_0.2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-1.el8_0.2?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-1.el8_0.2.x86_64",
                "product": {
                  "name": "libnghttp2-0:1.33.0-1.el8_0.2.x86_64",
                  "product_id": "libnghttp2-0:1.33.0-1.el8_0.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-1.el8_0.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-1.el8_0.2.x86_64",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-1.el8_0.2.x86_64",
                  "product_id": "nghttp2-debugsource-0:1.33.0-1.el8_0.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-1.el8_0.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-1.el8_0.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-1.el8_0.2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnghttp2-0:1.33.0-1.el8_0.2.ppc64le",
                "product": {
                  "name": "libnghttp2-0:1.33.0-1.el8_0.2.ppc64le",
                  "product_id": "libnghttp2-0:1.33.0-1.el8_0.2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2@1.33.0-1.el8_0.2?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debugsource-0:1.33.0-1.el8_0.2.ppc64le",
                "product": {
                  "name": "nghttp2-debugsource-0:1.33.0-1.el8_0.2.ppc64le",
                  "product_id": "nghttp2-debugsource-0:1.33.0-1.el8_0.2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debugsource@1.33.0-1.el8_0.2?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le",
                "product": {
                  "name": "libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le",
                  "product_id": "libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libnghttp2-debuginfo@1.33.0-1.el8_0.2?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le",
                "product": {
                  "name": "nghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le",
                  "product_id": "nghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2-debuginfo@1.33.0-1.el8_0.2?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nghttp2-0:1.33.0-1.el8_0.2.src",
                "product": {
                  "name": "nghttp2-0:1.33.0-1.el8_0.2.src",
                  "product_id": "nghttp2-0:1.33.0-1.el8_0.2.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nghttp2@1.33.0-1.el8_0.2?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-1.el8_0.2.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)",
          "product_id": "BaseOS-8.0.0.Z.E4S:libnghttp2-0:1.33.0-1.el8_0.2.i686"
        },
        "product_reference": "libnghttp2-0:1.33.0-1.el8_0.2.i686",
        "relates_to_product_reference": "BaseOS-8.0.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-1.el8_0.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)",
          "product_id": "BaseOS-8.0.0.Z.E4S:libnghttp2-0:1.33.0-1.el8_0.2.ppc64le"
        },
        "product_reference": "libnghttp2-0:1.33.0-1.el8_0.2.ppc64le",
        "relates_to_product_reference": "BaseOS-8.0.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-0:1.33.0-1.el8_0.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)",
          "product_id": "BaseOS-8.0.0.Z.E4S:libnghttp2-0:1.33.0-1.el8_0.2.x86_64"
        },
        "product_reference": "libnghttp2-0:1.33.0-1.el8_0.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.0.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)",
          "product_id": "BaseOS-8.0.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686",
        "relates_to_product_reference": "BaseOS-8.0.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)",
          "product_id": "BaseOS-8.0.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le",
        "relates_to_product_reference": "BaseOS-8.0.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)",
          "product_id": "BaseOS-8.0.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64"
        },
        "product_reference": "libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.0.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-0:1.33.0-1.el8_0.2.src as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)",
          "product_id": "BaseOS-8.0.0.Z.E4S:nghttp2-0:1.33.0-1.el8_0.2.src"
        },
        "product_reference": "nghttp2-0:1.33.0-1.el8_0.2.src",
        "relates_to_product_reference": "BaseOS-8.0.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)",
          "product_id": "BaseOS-8.0.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686",
        "relates_to_product_reference": "BaseOS-8.0.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)",
          "product_id": "BaseOS-8.0.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le",
        "relates_to_product_reference": "BaseOS-8.0.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)",
          "product_id": "BaseOS-8.0.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64"
        },
        "product_reference": "nghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.0.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-1.el8_0.2.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)",
          "product_id": "BaseOS-8.0.0.Z.E4S:nghttp2-debugsource-0:1.33.0-1.el8_0.2.i686"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-1.el8_0.2.i686",
        "relates_to_product_reference": "BaseOS-8.0.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-1.el8_0.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)",
          "product_id": "BaseOS-8.0.0.Z.E4S:nghttp2-debugsource-0:1.33.0-1.el8_0.2.ppc64le"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-1.el8_0.2.ppc64le",
        "relates_to_product_reference": "BaseOS-8.0.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nghttp2-debugsource-0:1.33.0-1.el8_0.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)",
          "product_id": "BaseOS-8.0.0.Z.E4S:nghttp2-debugsource-0:1.33.0-1.el8_0.2.x86_64"
        },
        "product_reference": "nghttp2-debugsource-0:1.33.0-1.el8_0.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.0.0.Z.E4S"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "the Envoy security team"
          ]
        }
      ],
      "cve": "CVE-2020-11080",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2020-06-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1844929"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A resource consumption vulnerability was found in nghttp2. This flaw allows an attacker to repeatedly construct an overly large HTTP/2 SETTINGS frame with a length of 14,400 bytes that causes excessive CPU usage, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: overly large SETTINGS frames can lead to DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.0.0.Z.E4S:libnghttp2-0:1.33.0-1.el8_0.2.i686",
          "BaseOS-8.0.0.Z.E4S:libnghttp2-0:1.33.0-1.el8_0.2.ppc64le",
          "BaseOS-8.0.0.Z.E4S:libnghttp2-0:1.33.0-1.el8_0.2.x86_64",
          "BaseOS-8.0.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686",
          "BaseOS-8.0.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le",
          "BaseOS-8.0.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64",
          "BaseOS-8.0.0.Z.E4S:nghttp2-0:1.33.0-1.el8_0.2.src",
          "BaseOS-8.0.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686",
          "BaseOS-8.0.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le",
          "BaseOS-8.0.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64",
          "BaseOS-8.0.0.Z.E4S:nghttp2-debugsource-0:1.33.0-1.el8_0.2.i686",
          "BaseOS-8.0.0.Z.E4S:nghttp2-debugsource-0:1.33.0-1.el8_0.2.ppc64le",
          "BaseOS-8.0.0.Z.E4S:nghttp2-debugsource-0:1.33.0-1.el8_0.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-11080"
        },
        {
          "category": "external",
          "summary": "RHBZ#1844929",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1844929"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11080",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-11080"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11080",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11080"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr"
        }
      ],
      "release_date": "2020-06-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-07-07T09:03:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.0.0.Z.E4S:libnghttp2-0:1.33.0-1.el8_0.2.i686",
            "BaseOS-8.0.0.Z.E4S:libnghttp2-0:1.33.0-1.el8_0.2.ppc64le",
            "BaseOS-8.0.0.Z.E4S:libnghttp2-0:1.33.0-1.el8_0.2.x86_64",
            "BaseOS-8.0.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686",
            "BaseOS-8.0.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le",
            "BaseOS-8.0.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64",
            "BaseOS-8.0.0.Z.E4S:nghttp2-0:1.33.0-1.el8_0.2.src",
            "BaseOS-8.0.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686",
            "BaseOS-8.0.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le",
            "BaseOS-8.0.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64",
            "BaseOS-8.0.0.Z.E4S:nghttp2-debugsource-0:1.33.0-1.el8_0.2.i686",
            "BaseOS-8.0.0.Z.E4S:nghttp2-debugsource-0:1.33.0-1.el8_0.2.ppc64le",
            "BaseOS-8.0.0.Z.E4S:nghttp2-debugsource-0:1.33.0-1.el8_0.2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:2850"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.0.0.Z.E4S:libnghttp2-0:1.33.0-1.el8_0.2.i686",
            "BaseOS-8.0.0.Z.E4S:libnghttp2-0:1.33.0-1.el8_0.2.ppc64le",
            "BaseOS-8.0.0.Z.E4S:libnghttp2-0:1.33.0-1.el8_0.2.x86_64",
            "BaseOS-8.0.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686",
            "BaseOS-8.0.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le",
            "BaseOS-8.0.0.Z.E4S:libnghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64",
            "BaseOS-8.0.0.Z.E4S:nghttp2-0:1.33.0-1.el8_0.2.src",
            "BaseOS-8.0.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-1.el8_0.2.i686",
            "BaseOS-8.0.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-1.el8_0.2.ppc64le",
            "BaseOS-8.0.0.Z.E4S:nghttp2-debuginfo-0:1.33.0-1.el8_0.2.x86_64",
            "BaseOS-8.0.0.Z.E4S:nghttp2-debugsource-0:1.33.0-1.el8_0.2.i686",
            "BaseOS-8.0.0.Z.E4S:nghttp2-debugsource-0:1.33.0-1.el8_0.2.ppc64le",
            "BaseOS-8.0.0.Z.E4S:nghttp2-debugsource-0:1.33.0-1.el8_0.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: overly large SETTINGS frames can lead to DoS"
    }
  ]
}

cve-2020-11080

Vulnerability from cvelistv5

Published

2020-06-03 00:00

Modified

2024-08-04 11:21

Severity ?

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

Denial of service in nghttp2

References

▼	URL	Tags
	https://www.debian.org/security/2020/dsa-4696	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAC2AA36OTRHKSVM5OV7TTVB3CZIGEFL/	vendor-advisory
	https://www.oracle.com/security-alerts/cpujul2020.html
	https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr
	https://github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090
	https://github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394
	https://www.oracle.com/security-alerts/cpuoct2020.html
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/	vendor-advisory
	https://www.oracle.com/security-alerts/cpujan2021.html
	https://www.oracle.com//security-alerts/cpujul2021.html
	https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html	mailing-list
	https://www.oracle.com/security-alerts/cpuapr2022.html
	https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html	mailing-list

Impacted products

▼	Vendor	Product
	nghttp2	nghttp2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:21:14.514Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4696",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4696"
          },
          {
            "name": "openSUSE-SU-2020:0802",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html"
          },
          {
            "name": "FEDORA-2020-f7d15c8b77",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAC2AA36OTRHKSVM5OV7TTVB3CZIGEFL/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "name": "FEDORA-2020-43d5a372fc",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "name": "[debian-lts-announce] 20211017 [SECURITY] [DLA 2786-1] nghttp2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "name": "[debian-lts-announce] 20231016 [SECURITY] [DLA 3621-1] nghttp2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nghttp2",
          "vendor": "nghttp2",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.41.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., \u003e 32), then drop the connection."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-707",
              "description": "CWE-707 Improper Enforcement of Message or Data Structure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-16T17:06:24.016570",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "DSA-4696",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4696"
        },
        {
          "name": "openSUSE-SU-2020:0802",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html"
        },
        {
          "name": "FEDORA-2020-f7d15c8b77",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAC2AA36OTRHKSVM5OV7TTVB3CZIGEFL/"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr"
        },
        {
          "url": "https://github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090"
        },
        {
          "url": "https://github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "name": "FEDORA-2020-43d5a372fc",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "name": "[debian-lts-announce] 20211017 [SECURITY] [DLA 2786-1] nghttp2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "name": "[debian-lts-announce] 20231016 [SECURITY] [DLA 3621-1] nghttp2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html"
        }
      ],
      "source": {
        "advisory": "GHSA-q5wr-xfw9-q7xr",
        "discovery": "UNKNOWN"
      },
      "title": "Denial of service in nghttp2"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-11080",
    "datePublished": "2020-06-03T00:00:00",
    "dateReserved": "2020-03-30T00:00:00",
    "dateUpdated": "2024-08-04T11:21:14.514Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted