Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 568
Alerts This Week
Warning Icon 1 568

Ubuntu 20.04 LTS USN-6142-1 Critical: nghttp2 Denial Of Service

ubuntu
Calendar Grey June 6, 2023
Dist Ubuntu Esm H88
A vulnerability in the nghttp2 package for Ubuntu could cause service interruptions when a specially crafted file is accessed. It is important to act immediately.
nghttp2 could be made to crash if it opened a specially crafted file.

Summary

nghttp2 could be made to crash if it opened a specially crafted file.

Software Description:

- nghttp2: HTTP/2 C Library and tools

Details:

Gal Goldshtein discovered that nghttp2 incorrectly handled certain inputs. If

a user or an automated system were tricked into opening a specially crafted

input file, a remote attacker could possibly use this issue to cause a

denial of service.

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu service disruption nghttp2

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
   libnghttp2-14                   1.40.0-1ubuntu0.1
   libnghttp2-dev                  1.40.0-1ubuntu0.1
   nghttp2                         1.40.0-1ubuntu0.1
   nghttp2-client                  1.40.0-1ubuntu0.1
   nghttp2-proxy                   1.40.0-1ubuntu0.1
   nghttp2-server                  1.40.0-1ubuntu0.1

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
   libnghttp2-14                   1.30.0-1ubuntu1+esm1
   libnghttp2-dev                  1.30.0-1ubuntu1+esm1
   nghttp2                         1.30.0-1ubuntu1+esm1
   nghttp2-client                  1.30.0-1ubuntu1+esm1
   nghttp2-proxy                   1.30.0-1ubuntu1+esm1
   nghttp2-server                  1.30.0-1ubuntu1+esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
   libnghttp2-14                   1.7.1-1ubuntu0.1~esm1
   libnghttp2-dev                  1.7.1-1ubuntu0.1~esm1
   nghttp2                         1.7.1-1ubuntu0.1~esm1
   nghttp2-client                  1.7.1-1ubuntu0.1~esm1
   nghttp2-proxy                   1.7.1-1ubuntu0.1~esm1
   nghttp2-server                  1.7.1-1ubuntu0.1~esm1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6142-1

CVE-2020-11080

Severity
critical
Lowest
Low
Medium
High
Critical

June 06, 2023

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu service disruption nghttp2

Package Information

https://launchpad.net/ubuntu/+source/nghttp2/1.40.0-1ubuntu0.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.