Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Mageia 2020-0256: nghttp2 Update Fixes DoS Vulnerability CVE-2020-11080

mageia
Calendar Grey June 10, 2020
Dist Mageia Esm H88
Mageia 2020-0256 has upgraded nghttp2 to fix an identified denial of service vulnerability. Information and corrective measures are available.
nghttp2 has been updated to version 1.41.0 to fix CVE-2020-11080

Summary

nghttp2 has been updated to version 1.41.0 to fix CVE-2020-11080.
The overly large HTTP/2 SETTINGS frame payload causes denial of service.
The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%.

References

- https://bugs.mageia.org/show_bug.cgi?id=26725

- https://www.cve.org/CVERecord?id=CVE-2020-11080

Topics%20covered

Topics Covered

security advisory denial of service security issue software update nghttp2 Mageia CVE-2020-11080

Resolution

SRPMS

- 7/core/nghttp2-1.41.0-1.mga7

Severity
important
Lowest
Low
Medium
High
Critical

Publication date: 10 Jun 2020
URL: https://advisories.mageia.org/MGASA-2020-0256.html
Type: security
CVE: CVE-2020-11080

Topics%20covered

Topics Covered

security advisory denial of service security issue software update nghttp2 Mageia CVE-2020-11080

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here