Veracode Vulnerability DatabaseVERACODE:19705Denial Of Service (DoS) Through CPU Exhaustion
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
nginx is vulnerable to denial of service(DoS) attacks. A remote user could issue a specially crafted HTTP/2 request to cause excessive CPU consumption.
| CPE | Name | Operator | Version |
|---|---|---|---|
| rh-nginx114-nginx | eq | 1.14.0__3.el7 | |
| rh-nginx114-nginx | eq | 1.14.0__3.el7 |
References
lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html
mailman.nginx.org/pipermail/nginx-announce/2018/000220.html
seclists.org/fulldisclosure/2021/Sep/36
www.securityfocus.com/bid/105868
www.securitytracker.com/id/1042038
access.redhat.com/errata/RHSA-2018:3680
access.redhat.com/errata/RHSA-2018:3681
access.redhat.com/security/updates/classification/#important
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16844
support.apple.com/kb/HT212818
usn.ubuntu.com/3812-1/
www.debian.org/security/2018/dsa-4335
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C