Lucene search

DebianDEBIAN:DLA-3621-1:DE191

HistoryOct 16, 2023 - 2:26 p.m.

[SECURITY] [DLA 3621-1] nghttp2 security update

2023-10-1614:26:59

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.3 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.739 High

EPSS

Percentile

98.1%

JSON

Debian LTS Advisory DLA-3621-1 [email protected]
https://www.debian.org/lts/security/ Sean Whitton
October 16, 2023 https://wiki.debian.org/LTS

Package : nghttp2
Version : 1.36.0-2+deb10u2
CVE ID : CVE-2020-11080 CVE-2023-44487
Debian Bug : 962145 1053769

Multiple vulnerabilities were discovered in nghttp2, an implementation
of the HTTP/2 protocol.

CVE-2020-11080

A denial-of-service could be caused by a large HTTP/2 SETTINGS
frame payload.

CVE-2023-44487

A denial-of-service could be caused by resetting many HTTP/2
streams quickly.  This has been observed in the wild since August.

For Debian 10 buster, these problems have been fixed in version
1.36.0-2+deb10u2.

We recommend that you upgrade your nghttp2 packages.

For the detailed security status of nghttp2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/nghttp2

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian10i386trafficserver< 8.1.7-0+deb10u3trafficserver_8.1.7-0+deb10u3_i386.deb
Debian11armhflibnghttp2-dev< 1.43.0-1+deb11u1libnghttp2-dev_1.43.0-1+deb11u1_armhf.deb
Debian10alltomcat9-user< 9.0.31-1~deb10u9tomcat9-user_9.0.31-1~deb10u9_all.deb
Debian11i386trafficserver< 8.1.9+ds-1~deb11u1trafficserver_8.1.9+ds-1~deb11u1_i386.deb
Debian12amd64nghttp2-server-dbgsym< 1.52.0-1+deb12u1nghttp2-server-dbgsym_1.52.0-1+deb12u1_amd64.deb
Debian11armhftrafficserver-dev< 8.1.9+ds-1~deb11u1trafficserver-dev_8.1.9+ds-1~deb11u1_armhf.deb
Debian11mipseltrafficserver< 8.1.9+ds-1~deb11u1trafficserver_8.1.9+ds-1~deb11u1_mipsel.deb
Debian11mips64elnghttp2-server-dbgsym< 1.43.0-1+deb11u1nghttp2-server-dbgsym_1.43.0-1+deb11u1_mips64el.deb
Debian12arm64trafficserver-experimental-plugins< 9.2.3+ds-1+deb12u1+b2trafficserver-experimental-plugins_9.2.3+ds-1+deb12u1+b2_arm64.deb
Debian12arm64nghttp2-proxy< 1.52.0-1+deb12u1nghttp2-proxy_1.52.0-1+deb12u1_arm64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	i386	trafficserver	< 8.1.7-0+deb10u3	trafficserver_8.1.7-0+deb10u3_i386.deb
Debian	11	armhf	libnghttp2-dev	< 1.43.0-1+deb11u1	libnghttp2-dev_1.43.0-1+deb11u1_armhf.deb
Debian	10	all	tomcat9-user	< 9.0.31-1~deb10u9	tomcat9-user_9.0.31-1~deb10u9_all.deb
Debian	11	i386	trafficserver	< 8.1.9+ds-1~deb11u1	trafficserver_8.1.9+ds-1~deb11u1_i386.deb
Debian	12	amd64	nghttp2-server-dbgsym	< 1.52.0-1+deb12u1	nghttp2-server-dbgsym_1.52.0-1+deb12u1_amd64.deb
Debian	11	armhf	trafficserver-dev	< 8.1.9+ds-1~deb11u1	trafficserver-dev_8.1.9+ds-1~deb11u1_armhf.deb
Debian	11	mipsel	trafficserver	< 8.1.9+ds-1~deb11u1	trafficserver_8.1.9+ds-1~deb11u1_mipsel.deb
Debian	11	mips64el	nghttp2-server-dbgsym	< 1.43.0-1+deb11u1	nghttp2-server-dbgsym_1.43.0-1+deb11u1_mips64el.deb
Debian	12	arm64	trafficserver-experimental-plugins	< 9.2.3+ds-1+deb12u1+b2	trafficserver-experimental-plugins_9.2.3+ds-1+deb12u1+b2_arm64.deb
Debian	12	arm64	nghttp2-proxy	< 1.52.0-1+deb12u1	nghttp2-proxy_1.52.0-1+deb12u1_arm64.deb