USN-6754-1

Source
https://ubuntu.com/security/notices/USN-6754-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/USN-6754-1.json
Related
Published
2024-04-25T22:23:15.301978Z
Modified
2024-04-25T22:23:15.301978Z
Details

It was discovered that nghttp2 incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511, CVE-2019-9513)

It was discovered that nghttp2 incorrectly handled request cancellation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)

It was discovered that nghttp2 could be made to process an unlimited number of HTTP/2 CONTINUATION frames. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. (CVE-2024-28182)

References

Affected packages

Ubuntu:Pro:18.04:LTS / nghttp2

Package

Name
nghttp2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
1.30.0-1ubuntu1+esm2

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "nghttp2": "1.30.0-1ubuntu1+esm2",
            "libnghttp2-14": "1.30.0-1ubuntu1+esm2",
            "libnghttp2-dev": "1.30.0-1ubuntu1+esm2",
            "libnghttp2-doc": "1.30.0-1ubuntu1+esm2",
            "nghttp2-proxy": "1.30.0-1ubuntu1+esm2",
            "nghttp2-server": "1.30.0-1ubuntu1+esm2",
            "nghttp2-client": "1.30.0-1ubuntu1+esm2"
        }
    ]
}

Ubuntu:20.04:LTS / nghttp2

Package

Name
nghttp2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
1.40.0-1ubuntu0.3

Ecosystem specific 

{
    "availability": "No subscription needed",
    "binaries": [
        {
            "nghttp2": "1.40.0-1ubuntu0.3",
            "libnghttp2-14": "1.40.0-1ubuntu0.3",
            "libnghttp2-dev": "1.40.0-1ubuntu0.3",
            "libnghttp2-doc": "1.40.0-1ubuntu0.3",
            "nghttp2-proxy": "1.40.0-1ubuntu0.3",
            "nghttp2-server": "1.40.0-1ubuntu0.3",
            "nghttp2-client": "1.40.0-1ubuntu0.3"
        }
    ]
}

Ubuntu:22.04:LTS / nghttp2

Package

Name
nghttp2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
1.43.0-1ubuntu0.2

Ecosystem specific 

{
    "availability": "No subscription needed",
    "binaries": [
        {
            "nghttp2": "1.43.0-1ubuntu0.2",
            "libnghttp2-14": "1.43.0-1ubuntu0.2",
            "libnghttp2-dev": "1.43.0-1ubuntu0.2",
            "libnghttp2-doc": "1.43.0-1ubuntu0.2",
            "nghttp2-proxy": "1.43.0-1ubuntu0.2",
            "nghttp2-server": "1.43.0-1ubuntu0.2",
            "nghttp2-client": "1.43.0-1ubuntu0.2"
        }
    ]
}

Ubuntu:23.10 / nghttp2

Package

Name
nghttp2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
1.55.1-1ubuntu0.2

Ecosystem specific 

{
    "availability": "No subscription needed",
    "binaries": [
        {
            "nghttp2": "1.55.1-1ubuntu0.2",
            "libnghttp2-14": "1.55.1-1ubuntu0.2",
            "libnghttp2-dev": "1.55.1-1ubuntu0.2",
            "libnghttp2-doc": "1.55.1-1ubuntu0.2",
            "nghttp2-proxy": "1.55.1-1ubuntu0.2",
            "nghttp2-server": "1.55.1-1ubuntu0.2",
            "nghttp2-client": "1.55.1-1ubuntu0.2"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / nghttp2

Package

Name
nghttp2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
1.7.1-1ubuntu0.1~esm2

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "nghttp2": "1.7.1-1ubuntu0.1~esm2",
            "libnghttp2-14": "1.7.1-1ubuntu0.1~esm2",
            "libnghttp2-dev": "1.7.1-1ubuntu0.1~esm2",
            "libnghttp2-doc": "1.7.1-1ubuntu0.1~esm2",
            "nghttp2-proxy": "1.7.1-1ubuntu0.1~esm2",
            "nghttp2-server": "1.7.1-1ubuntu0.1~esm2",
            "nghttp2-client": "1.7.1-1ubuntu0.1~esm2"
        }
    ]
}