AXSA:2020-326:01

リリース日: 
2020/09/10 Thursday - 08:52
題名: 
nghttp2-1.33.0-3.el8.1
影響のあるチャネル: 
Asianux Server 8 for x86_64
Severity: 
High
Description: 

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

* nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2020-11080
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

解決策: 

Update packages.

追加情報: 

N/A

ダウンロード: 

SRPMS
  1. nghttp2-1.33.0-3.el8.1.src.rpm
    MD5: 09f60fd61ba585caf605bb1c1d925d60
    SHA-256: 72e241016c3f91954e5c8647e9e5f618ff2be0b37c8f74f73d89d3f7dad30238
    Size: 1.51 MB

Asianux Server 8 for x86_64
  1. libnghttp2-1.33.0-3.el8.1.x86_64.rpm
    MD5: be82d91f75dbdb37d9f62ad626b3e37e
    SHA-256: f052006b10093147008ae918115320192b68baa3938e56b2f46d040bc7f28e97
    Size: 76.65 kB
  2. libnghttp2-1.33.0-3.el8.1.i686.rpm
    MD5: 265e59f95f1a16775d70f38c4fbfd01a
    SHA-256: 30b68949c9d4f1c6d1dcda3461502630390336dda3722ea95a97b9266fb09f56
    Size: 82.76 kB
Copyright© 2007-2015 Asianux. All rights reserved.