Skip to content
OpenAdvisories
High ELSA-2019-2799 3 CVEs

Important: nginx:1.14 security update (Oracle Linux 8)

Published Sep 19, 2019 · Updated Sep 19, 2019

Ecosystem: Oracle Linux

Summary

[1:1.14.1-9.0.1]
- Remove Red Hat references [Orabug: 29498217]

[1:1.14.1-9]
- Resolves: #1744811 - CVE-2019-9511 nginx:1.14/nginx: HTTP/2: large amount of
data request leads to denial of service
- Resolves: #1744325 - CVE-2019-9513 nginx:1.14/nginx: HTTP/2: flood using
PRIORITY frames resulting in excessive resource consumption
- Resolves: #1745094 - CVE-2019-9516 nginx:1.14/nginx: HTTP/2: 0-length
headers leads to denial of service

Fixed packages 8

ReleasePackageFixed in
Oracle Linux · 8 nginx 1:1.14.1-9.0.1.module+el8.0.0+5347+9282027e
Oracle Linux · 8 nginx-all-modules 1:1.14.1-9.0.1.module+el8.0.0+5347+9282027e
Oracle Linux · 8 nginx-filesystem 1:1.14.1-9.0.1.module+el8.0.0+5347+9282027e
Oracle Linux · 8 nginx-mod-http-image-filter 1:1.14.1-9.0.1.module+el8.0.0+5347+9282027e
Oracle Linux · 8 nginx-mod-http-perl 1:1.14.1-9.0.1.module+el8.0.0+5347+9282027e
Oracle Linux · 8 nginx-mod-http-xslt-filter 1:1.14.1-9.0.1.module+el8.0.0+5347+9282027e
Oracle Linux · 8 nginx-mod-mail 1:1.14.1-9.0.1.module+el8.0.0+5347+9282027e
Oracle Linux · 8 nginx-mod-stream 1:1.14.1-9.0.1.module+el8.0.0+5347+9282027e

Vulnerabilities 3

  • High 7.5
    CVE-2019-9511 Public exploit EPSS 60%

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manip…

    nodejs nodejs nodejs nginx Debian Ubuntu Alpine
  • High 7.5
    CVE-2019-9513 Public exploit EPSS 82%

    Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority…

    nodejs nodejs nodejs nginx Debian Ubuntu Alpine
  • High 7.5
    CVE-2019-9516 EPSS 57%

    Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. S…

    nodejs nginx nginx nginx Debian Ubuntu Alpine