Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
202
security advisorymoderatedenial of serviceopenSUSE Leap 15.0: 2019:2234-1 Moderate: nghttp2 DoS Threats
An update that solves two vulnerabilities and has three fixes is now available.. openSUSE Security Update: Security update for nghttp2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2234-1 Rating: moderate References: #1112438 #1125689 #1134616 #1146182 #1146184 Cross-References: CVE-2019-9511 CVE-2019-9513 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for nghttp2 fixes the following issues: Security issues fixed: - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184). - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#11461). Bug fixes and enhancements: - Fixed mistake in spec file (bsc#1125689) - Fixed build issue with boost 1.70.0 (bsc#1134616) - Feature: Add W&S module (FATE#326776, bsc#1112438) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2234=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libnghttp2-14-1.39.2-lp150.2.3.1 libnghttp2-14-debuginfo-1.39.2-lp150.2.3.1 libnghttp2-devel-1.39.2-lp150.2.3.1 libnghttp2_asio-devel-1.39.2-lp150.2.3.1 libnghttp2_asio1-1.39.2-lp150.2.3.1 libnghttp2_asio1-debuginfo-1.39.2-lp150.2.3.1 nghttp2-1.39.2-lp150.2.3.1 nghttp2-debuginfo-1.39.2-lp150.2.3.1 nghttp2-debugsource-1.39.2-lp150.2.3.1 nghttp2-python-debugsource-1.39.2-lp150.2.3.1 python3-nghttp2-1.39.2-lp150.2.3.1 python3-nghttp2-debuginfo-1.39.2-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libnghttp2-14-32bit-1.39.2-lp150.2.3.1 libnghttp2-14-32bit-debuginfo-1.39.2-lp150.2.3.1 libnghttp2_asio1-32bit-1.39.2-lp150.2.3.1 libnghttp2_asio1-32bit-debuginfo-1.39.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-9511.html https://www.suse.com/security/cve/CVE-2019-9513.html https://bugzilla.suse.com/1112438 https://bugzilla.suse.com/1125689 https://bugzilla.suse.com/1134616 https://bugzilla.suse.com/1146182 https://bugzilla.suse.com/1146184 -- . An important news release for Fedora tackling low-level security vulnerabilities in curl, improving system stability and efficiency.. nghttp2 Patch, openSUSE Update, Security Advisory, HTTP/2 Issues, DoS Prevention. . LinuxSecurity.com Team
Oct 01, 2019
OpenSUSE
203
security advisorydenial of serviceCPU consumptionMageia 6, 7: MGASA-2019-0291 Critical: nghttp2 Denial of Service
The updated packages fix security vulnerabilities: Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified . MGASA-2019-0291 - Updated nghttp2 packages fix security vulnerabilities Publication date: 28 Sep 2019 URL: https://advisories.mageia.org/MGASA-2019-0291.html Type: security Affected Mageia releases: 6, 7 CVE: CVE-2019-9511, CVE-2019-9513 The updated packages fix security vulnerabilities: Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. (CVE-2019-9511) Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU. (CVE-2019-9513) References: - https://bugs.mageia.org/show_bug.cgi?id=25424 - https://access.redhat.com/errata/RHSA-2019:2692 - https://www.cve.org/CVERecord?id=CVE-2019-9511 - https://www.cve.org/CVERecord?id=CVE-2019-9513 SRPMS: - 7/core/nghttp2-1.38.0-1.1.mga7 - 6/core/nghttp2-1.9.2-1.1.mga6 . Mageia 2020-0454 implements changes to OpenSSL to address vulnerabilities associated with cryptographic functions and potential man-in-the-middle threats for secure communications.. nghttp2, Mageia, HTTP/2, denial of service, security risks. . Severity: Critical. LinuxSecurity.com Team
Sep 27, 2019
•Critical
Mageia
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!