nghttp2-1.33.0-3.el8.1

エラータID: AXSA:2020-326:01

リリース日: 
2020/09/10 Thursday - 09:52
題名: 
nghttp2-1.33.0-3.el8.1
影響のあるチャネル: 
Asianux Server 8 for x86_64
Severity: 
High
Description: 

以下項目について対処しました。

[Security Fix]
- nodejs の nghttp2 には、攻撃者が巨大な HTTP/2 の SETTINGS フレーム
のペイロードによって、サービス拒否を引き起こすことのできる脆弱性が
あります。(CVE-2020-11080)

解決策: 

パッケージをアップデートしてください。

CVE: 
CVE-2020-11080
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.
追加情報: 

N/A

ダウンロード: 

SRPMS
  1. nghttp2-1.33.0-3.el8.1.src.rpm
    MD5: 09f60fd61ba585caf605bb1c1d925d60
    SHA-256: 72e241016c3f91954e5c8647e9e5f618ff2be0b37c8f74f73d89d3f7dad30238
    Size: 1.51 MB

Asianux Server 8 for x86_64
  1. libnghttp2-1.33.0-3.el8.1.x86_64.rpm
    MD5: be82d91f75dbdb37d9f62ad626b3e37e
    SHA-256: f052006b10093147008ae918115320192b68baa3938e56b2f46d040bc7f28e97
    Size: 76.65 kB
  2. libnghttp2-1.33.0-3.el8.1.i686.rpm
    MD5: 265e59f95f1a16775d70f38c4fbfd01a
    SHA-256: 30b68949c9d4f1c6d1dcda3461502630390336dda3722ea95a97b9266fb09f56
    Size: 82.76 kB