FlawAtlas
Search the atlas
SUSE-SU-2021:0932-1 Not scored

Security update for nghttp2

This update for nghttp2 fixes the following issues: Security issues fixed: - CVE-2020-11080: HTTP/2 Large Settings Frame DoS (bsc#1181358). - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184). - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146182). - CVE-2018-1000168: Fixed ALTSVC frame client side denial of service (bsc#1088639). - CVE-2016-1544: Fixed out of memory due to unlimited incoming HTTP header fields (bsc#966514). Bug fixes and enhancements: - Packages must not mark license files as %doc (bsc#1082318) - Typo in description of libnghttp2_asio1 (bsc#962914) - Fixed mistake in spec file (bsc#1125689) - Fixed build issue with boost 1.70.0 (bsc#1134616) - Fixed build issue with GCC 6 (bsc#964140) - Feature: Add W&S module (FATE#326776, bsc#1112438)

Exploit probability Not scored
Published March 24, 2021
Required by Not available
Last source change February 4, 2026

02 / AFFECTED SOFTWARE

Affected packages

SUSE:HPE Helion OpenStack 8 nghttp2
SUSE:Linux Enterprise Server 12 SP2-BCL nghttp2
SUSE:Linux Enterprise Server 12 SP2-LTSS nghttp2
SUSE:Linux Enterprise Server 12 SP3-BCL nghttp2
SUSE:Linux Enterprise Server 12 SP3-LTSS nghttp2
SUSE:Linux Enterprise Server 12 SP4-LTSS nghttp2
SUSE:Linux Enterprise Server 12 SP5 nghttp2
SUSE:Linux Enterprise Server for SAP Applications 12 SP2 nghttp2
SUSE:Linux Enterprise Server for SAP Applications 12 SP3 nghttp2
SUSE:Linux Enterprise Server for SAP Applications 12 SP4 nghttp2
SUSE:Linux Enterprise Server for SAP Applications 12 SP5 nghttp2
SUSE:OpenStack Cloud 7 nghttp2
SUSE:OpenStack Cloud 8 nghttp2
SUSE:OpenStack Cloud 9 nghttp2
SUSE:OpenStack Cloud Crowbar 8 nghttp2
SUSE:OpenStack Cloud Crowbar 9 nghttp2

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-SU-2021:0932-1

This update for nghttp2 fixes the following issues: Security issues fixed: - CVE-2020-11080: HTTP/2 Large Settings Frame DoS (bsc#1181358). - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184). - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146182). - CVE-2018-1000168: Fixed ALTSVC frame client side denial of service (bsc#1088639). - CVE-2016-1544: Fixed out of memory due to unlimited incoming HTTP header fields (bsc#966514). Bug fixes and enhancements: - Packages must not mark license files as %doc (bsc#1082318) - Typo in description of libnghttp2_asio1 (bsc#962914) - Fixed mistake in spec file (bsc#1125689) - Fixed build issue with boost 1.70.0 (bsc#1134616) - Fixed build issue with GCC 6 (bsc#964140) - Feature: Add W&S module (FATE#326776, bsc#1112438)

View original source

05 / REFERENCES

Further evidence