Skip to content
OpenAdvisories
High ALAS2-2020-1445 1 CVE

Important: nghttp2 security update (Amazon Linux 2)

Published Jun 26, 2020 · Updated Jul 1, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-11080: In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection. 1844929: CVE-2020-11080 nghttp2: overly large SETTINGS frames can lead to DoS

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 libnghttp2 0:1.41.0-1.amzn2
Amazon Linux · 2 libnghttp2-devel 0:1.41.0-1.amzn2
Amazon Linux · 2 nghttp2 0:1.41.0-1.amzn2
Amazon Linux · 2 nghttp2-debuginfo 0:1.41.0-1.amzn2

Vulnerabilities 1

  • Low 3.7
    CVE-2020-11080

    Denial of service in nghttp2

    In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) o…

    nghttp2 nghttp2 nodejs nodejs Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-11080.html