Bug 26361

Summary:	nghttp2 new security issue CVE-2019-18802
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	critical
Priority:	Normal	CC:	andrewsfarm, davidwhodgins, herman.viaene, sysadmin-bugs
Version:	7	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA7-64-OK
Source RPM:	nghttp2-1.38.0-1.1.mga7.src.rpm	CVE:	CVE-2019-18802
Status comment:

Description David Walser 2020-03-19 16:18:28 CET

SUSE has issued an advisory today (March 19):
http://lists.suse.com/pipermail/sle-security-updates/2020-March/006627.html

I believe the issue is fixed upstream in 1.40.0.

Comment 1 Nicolas Salguero 2020-03-20 13:53:32 CET

Suggested advisory:
========================

The updated packages fix a security vulnerability:

An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass "example.com" matchers. (CVE-2019-18802)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18802
http://lists.suse.com/pipermail/sle-security-updates/2020-March/006627.html
========================

Updated packages in core/updates_testing:
========================
nghttp2-1.38.0-1.2.mga7
lib(64)nghttp2_14-1.38.0-1.2.mga7
lib(64)nghttp2-devel-1.38.0-1.2.mga7

from SRPMS:
nghttp2-1.38.0-1.2.mga7.src.rpm

Status: NEW => ASSIGNED
CVE: (none) => CVE-2019-18802
Assignee: nicolas.salguero => qa-bugs

Comment 2 David Walser 2020-03-20 13:56:13 CET

CVE description describes envoy, not nghttp2.  How about this:

Suggested advisory:
========================

Updated nghttp2 packages fix security vulnerability:

Malformed request header may cause route matchers or access controls to be
bypassed, resulting in escalation of privileges or information disclosure
(CVE-2019-18802).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18802
http://lists.suse.com/pipermail/sle-security-updates/2020-March/006627.html

Comment 3 Herman Viaene 2020-03-21 11:46:30 CET

MGA7-64 Plasma on Lenovo B50
No installation issues.
Testing as in bug 25424, giving exactly the same results (commands and feedback identical).
So OK for me.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA7-64-OK

Comment 4 Thomas Andrews 2020-03-22 18:51:13 CET

Validating. Best advisory is in Comment 2.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Dave Hodgins 2020-03-31 23:17:53 CEST

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 5 Mageia Robot 2020-04-01 03:58:24 CEST

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2020-0147.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED