rh-nginx114-nginx-1.14.1-1.1.0.1.el7.AXS7, rh-nginx114-1.14-6.el7

Nginx is a web and proxy server with a focus on high concurrency, performance,
and low memory usage.

This enhancement update adds the rh-nginx114 packages to Asianux Software
Collections.

Security Fix(es):

* HTTP/2: large amount of data request leads to denial of service
(CVE-2019-9511)

* HTTP/2: flood using PRIORITY frames resulting in excessive resource
consumption (CVE-2019-9513)

* HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

CVE-2019-9511
Some HTTP/2 implementations are vulnerable to window size manipulation and
stream prioritization manipulation, potentially leading to a denial of service.
The attacker requests a large amount of data from a specified resource over
multiple streams. They manipulate window size and stream priority to force the
server to queue the data in 1-byte chunks. Depending on how efficiently this
data is queued, this can consume excess CPU, memory, or both.
CVE-2019-9513

CVE-2019-9516
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading
to a denial of service. The attacker sends a stream of headers with a 0-length
header name and 0-length header value, optionally Huffman encoded into 1-byte or
greater headers. Some implementations allocate memory for these headers and keep
the allocation alive until the session dies. This can consume excess memory.