EulerOS Virtualization 2.10.1 : httpd (EulerOS-SA-2024-2139)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP...

CBL Mariner 2.0 Security Update: httpd / mod_http2 (CVE-2024-27316)

The version of httpd / modhttp2 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-27316 advisory. - HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to genera...

CVE-2024-28182 affecting package nghttp2 for versions less than 1.61.0-1

CVE-2024-28182 affecting package nghttp2 for versions less than 1.61.0-1. An upgraded version of the package is available that resolves this issue...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details...

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from Golang Go http2 and nghttp2

Summary IBM MQ Operator and Queue manager container images are vulnerable to Golang Go http2 and nghttp2. This bulletin identifies the steps required to address these vulnerabilities Vulnerability Details CVEID:CVE-2023-45288 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by ...

GLSA-202408-10 : nghttp2: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202408-10 nghttp2: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in nghttp2. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly...

nghttp2: Multiple Vulnerabilities

Background Nghttp2 is an implementation of HTTP/2 and its header compression algorithm HPACK in C. Description Multiple vulnerabilities have been discovered in nghttp2. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

macOS 14.x < 14.6 Multiple Vulnerabilities (HT214119)

The remote host is running a version of macOS / Mac OS X that is 14.x prior to 14.6. It is, therefore, affected by multiple vulnerabilities: - A race condition was addressed with improved locking. This issue is fixed in macOS Ventura 13.3. An app may bypass Gatekeeper checks. CVE-2023-27952 -...

nghttp2: CONTINUATION frames DoS

A vulnerability was found in how nghttp2 implements the HTTP/2 protocol. There are insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single stream. This issue could allow an unauthenticated remote attacker to send packets to vulnerable servers, which...

Important: Red Hat Security Advisory: nodejs:18 security update

An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Photon OS 3.0: Nghttp2 PHSA-2023-3.0-0673

An update of the nghttp2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-3.0-0673. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 4.0: Nghttp2 PHSA-2023-4.0-0496

An update of the nghttp2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-4.0-0496. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Nghttp2 PHSA-2024-5.0-0242

An update of the nghttp2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-0242. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Moderate: Red Hat Security Advisory: nghttp2 security update

An update for nghttp2 is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as...

nghttp2: CONTINUATION frames DoS

A vulnerability was found in how nghttp2 implements the HTTP/2 protocol. There are insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single stream. This issue could allow an unauthenticated remote attacker to send packets to vulnerable servers, which...

Photon OS 4.0: Nghttp2 PHSA-2023-4.0-0379

An update of the nghttp2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-4.0-0379. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 4.0: Nghttp2 PHSA-2024-4.0-0591

An update of the nghttp2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-4.0-0591. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

RHEL 8 : nghttp2 (RHSA-2024:4732)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4732 advisory. libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: CONTINUATION frames DoS...

Photon OS 5.0: Nghttp2 PHSA-2023-5.0-0126

An update of the nghttp2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-0126. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

RHEL 9 : nodejs (RHSA-2024:4721)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4721 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...