Skip to content
OpenAdvisories
High ELSA-2019-2692 2 CVEs

Important: nghttp2 security update (Oracle Linux 8)

Published Sep 10, 2019 · Updated Sep 10, 2019

Ecosystem: Oracle Linux

Summary

[1.33.0-1.el8_0_0.1]
- backport security fixes from nghttp2-1.39.2 (CVE-2019-9511 and CVE-2019-9513)

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 8 libnghttp2 0:1.33.0-1.el8_0.1
Oracle Linux · 8 libnghttp2-devel 0:1.33.0-1.el8_0.1
Oracle Linux · 8 nghttp2 0:1.33.0-1.el8_0.1

Vulnerabilities 2

  • High 7.5
    CVE-2019-9511 Public exploit EPSS 60%

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manip…

    nodejs nodejs nodejs nginx Debian Ubuntu Alpine
  • High 7.5
    CVE-2019-9513 Public exploit EPSS 82%

    Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority…

    nodejs nodejs nodejs nginx Debian Ubuntu Alpine