| Summary: | nghttp2 new security issue CVE-2020-11080 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | Stig-Ørjan Smelror <smelror> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | andrewsfarm, herman.viaene, luigiwalser, mageia, sysadmin-bugs |
| Version: | 7 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA7-64-OK | ||
| Source RPM: | nghttp2-1.38.0-1.2.mga7.src.rpm | CVE: | |
| Status comment: | |||
| Bug Depends on: | |||
| Bug Blocks: | 25314 | ||
|
Description
Stig-Ørjan Smelror
2020-06-03 21:20:03 CEST
Advisory ======== Upstream has issued two patches that fixes CVE-2020-11080. The overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. References ========== https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr Files ===== Uploaded to core/updates_testing lib64nghttp2-devel-1.40.0-1.1.mga7 lib64nghttp2_14-1.40.0-1.1.mga7 lib64nghttp2_14-debuginfo-1.40.0-1.1.mga7 nghttp2-1.40.0-1.1.mga7 from nghttp2-1.40.0-1.1.mga7.src.rpm Assignee:
smelror =>
qa-bugs The current version of nghttp2 in Mageia 7 is 1.38.0. We updated it to 1.40.0 for the nodejs update. Since we're updating it anyway, is there a reason to not just update it to 1.41.0? Summary:
nghttp2 CVE-2020-11080 =>
nghttp2 new security issue CVE-2020-11080
David Walser
2020-06-03 21:36:54 CEST
Blocks:
(none) =>
25314 I was considering this, however was worried about compatibility with NodeJS. We had to update it to at least 1.39.0 for compatibility with nodejs, and the newest nodejs we have to update to, the upstream build of it bundles 1.41.0, so for compatibility we'd be better off updating it. CC:
(none) =>
luigiwalser Thanks. I'll push 1.41.0 to mga7. Cheers, Stig Advisory ======== nghttp2 has been updated to version 1.41.0 to fix CVE-2020-11080. The overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. References ========== https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr Files ===== Uploaded to core/updates_testing lib64nghttp2-devel-1.41.0-1.mga7 lib64nghttp2_14-1.41.0-1.mga7 nghttp2-1.41.0-1.mga7 from nghttp2-1.41.0-1.mga7.src.rpm Keywords:
feedback =>
(none) References should also include: https://github.com/nghttp2/nghttp2/releases/tag/v1.39.0 https://github.com/nghttp2/nghttp2/releases/tag/v1.39.1 https://github.com/nghttp2/nghttp2/releases/tag/v1.39.2 https://github.com/nghttp2/nghttp2/releases/tag/v1.40.0 https://github.com/nghttp2/nghttp2/releases/tag/v1.41.0 Advisory ======== nghttp2 has been updated to version 1.41.0 to fix CVE-2020-11080. The overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. References ========== https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr https://github.com/nghttp2/nghttp2/releases/tag/v1.39.0 https://github.com/nghttp2/nghttp2/releases/tag/v1.39.1 https://github.com/nghttp2/nghttp2/releases/tag/v1.39.2 https://github.com/nghttp2/nghttp2/releases/tag/v1.40.0 https://github.com/nghttp2/nghttp2/releases/tag/v1.41.0 Files ===== Uploaded to core/updates_testing lib64nghttp2-devel-1.41.0-1.mga7 lib64nghttp2_14-1.41.0-1.mga7 nghttp2-1.41.0-1.mga7 from nghttp2-1.41.0-1.mga7.src.rpm MGA7-64 Plasma on Lenovo B50 No installation issues. Testing as in bug 25424, giving exactly the same results (commands and feedback identical). So OK for me. Whiteboard:
(none) =>
MGA7-64-OK Validating. Advisory in Comment 8. Keywords:
(none) =>
validated_update
Nicolas Lécureuil
2020-06-11 01:18:24 CEST
Keywords:
(none) =>
advisory An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2020-0256.html Status:
NEW =>
RESOLVED |