179 lines
18 KiB
XML
179 lines
18 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
|
|
<DocumentTitle xml:lang="en">An update for nghttp2 is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS,openEuler-22.03-LTS-SP1,openEuler-22.03-LTS-SP2 and openEuler-22.03-LTS-SP3</DocumentTitle>
|
|
<DocumentType>Security Advisory</DocumentType>
|
|
<DocumentPublisher Type="Vendor">
|
|
<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
|
|
<IssuingAuthority>openEuler security committee</IssuingAuthority>
|
|
</DocumentPublisher>
|
|
<DocumentTracking>
|
|
<Identification>
|
|
<ID>openEuler-SA-2024-1389</ID>
|
|
</Identification>
|
|
<Status>Final</Status>
|
|
<Version>1.0</Version>
|
|
<RevisionHistory>
|
|
<Revision>
|
|
<Number>1.0</Number>
|
|
<Date>2024-04-12</Date>
|
|
<Description>Initial</Description>
|
|
</Revision>
|
|
</RevisionHistory>
|
|
<InitialReleaseDate>2024-04-12</InitialReleaseDate>
|
|
<CurrentReleaseDate>2024-04-12</CurrentReleaseDate>
|
|
<Generator>
|
|
<Engine>openEuler SA Tool V1.0</Engine>
|
|
<Date>2024-04-12</Date>
|
|
</Generator>
|
|
</DocumentTracking>
|
|
<DocumentNotes>
|
|
<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">nghttp2 security update</Note>
|
|
<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for nghttp2 is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS,openEuler-22.03-LTS-SP1,openEuler-22.03-LTS-SP2 and openEuler-22.03-LTS-SP3.</Note>
|
|
<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">The framing layer of HTTP/2 is implemented as a form of reusable C library. On top of that, we have implemented HTTP/2 client, server and proxy. We have also developed load test and benchmarking tool for HTTP/2.
|
|
|
|
Security Fix(es):
|
|
|
|
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.(CVE-2024-28182)</Note>
|
|
<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for nghttp2 is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS,openEuler-22.03-LTS-SP1,openEuler-22.03-LTS-SP2 and openEuler-22.03-LTS-SP3.
|
|
|
|
openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
|
|
<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">Medium</Note>
|
|
<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">nghttp2</Note>
|
|
</DocumentNotes>
|
|
<DocumentReferences>
|
|
<Reference Type="Self">
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1389</URL>
|
|
</Reference>
|
|
<Reference Type="openEuler CVE">
|
|
<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2024-28182</URL>
|
|
</Reference>
|
|
<Reference Type="Other">
|
|
<URL>https://nvd.nist.gov/vuln/detail/CVE-2024-28182</URL>
|
|
</Reference>
|
|
</DocumentReferences>
|
|
<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
|
|
<Branch Type="Product Name" Name="openEuler">
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">openEuler-20.03-LTS-SP1</FullProductName>
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">openEuler-20.03-LTS-SP4</FullProductName>
|
|
<FullProductName ProductID="openEuler-22.03-LTS" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">openEuler-22.03-LTS</FullProductName>
|
|
<FullProductName ProductID="openEuler-22.03-LTS-SP1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">openEuler-22.03-LTS-SP1</FullProductName>
|
|
<FullProductName ProductID="openEuler-22.03-LTS-SP2" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">openEuler-22.03-LTS-SP2</FullProductName>
|
|
<FullProductName ProductID="openEuler-22.03-LTS-SP3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">openEuler-22.03-LTS-SP3</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="aarch64">
|
|
<FullProductName ProductID="libnghttp2-1.41.0-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">libnghttp2-1.41.0-5.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-devel-1.41.0-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">libnghttp2-devel-1.41.0-5.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debugsource-1.41.0-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nghttp2-debugsource-1.41.0-5.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debuginfo-1.41.0-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nghttp2-debuginfo-1.41.0-5.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.41.0-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nghttp2-1.41.0-5.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-devel-1.41.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">libnghttp2-devel-1.41.0-6.oe2003sp4.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-1.41.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">libnghttp2-1.41.0-6.oe2003sp4.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debuginfo-1.41.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">nghttp2-debuginfo-1.41.0-6.oe2003sp4.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.41.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">nghttp2-1.41.0-6.oe2003sp4.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debugsource-1.41.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">nghttp2-debugsource-1.41.0-6.oe2003sp4.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-1.46.0-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">libnghttp2-1.46.0-5.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-devel-1.46.0-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">libnghttp2-devel-1.46.0-5.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debugsource-1.46.0-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">nghttp2-debugsource-1.46.0-5.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debuginfo-1.46.0-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">nghttp2-debuginfo-1.46.0-5.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.46.0-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">nghttp2-1.46.0-5.oe2203.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debuginfo-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">nghttp2-debuginfo-1.46.0-6.oe2203sp1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-devel-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">libnghttp2-devel-1.46.0-6.oe2203sp1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">libnghttp2-1.46.0-6.oe2203sp1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debugsource-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">nghttp2-debugsource-1.46.0-6.oe2203sp1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">nghttp2-1.46.0-6.oe2203sp1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">libnghttp2-1.46.0-6.oe2203sp2.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debuginfo-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">nghttp2-debuginfo-1.46.0-6.oe2203sp2.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-devel-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">libnghttp2-devel-1.46.0-6.oe2203sp2.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debugsource-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">nghttp2-debugsource-1.46.0-6.oe2203sp2.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">nghttp2-1.46.0-6.oe2203sp2.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debuginfo-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">nghttp2-debuginfo-1.46.0-6.oe2203sp3.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-devel-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">libnghttp2-devel-1.46.0-6.oe2203sp3.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">nghttp2-1.46.0-6.oe2203sp3.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debugsource-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">nghttp2-debugsource-1.46.0-6.oe2203sp3.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">libnghttp2-1.46.0-6.oe2203sp3.aarch64.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="noarch">
|
|
<FullProductName ProductID="nghttp2-help-1.41.0-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nghttp2-help-1.41.0-5.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-help-1.41.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">nghttp2-help-1.41.0-6.oe2003sp4.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-help-1.46.0-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">nghttp2-help-1.46.0-5.oe2203.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-help-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">nghttp2-help-1.46.0-6.oe2203sp1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-help-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">nghttp2-help-1.46.0-6.oe2203sp2.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-help-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">nghttp2-help-1.46.0-6.oe2203sp3.noarch.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="src">
|
|
<FullProductName ProductID="nghttp2-1.41.0-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nghttp2-1.41.0-5.oe1.src.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.41.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">nghttp2-1.41.0-6.oe2003sp4.src.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.46.0-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">nghttp2-1.46.0-5.oe2203.src.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">nghttp2-1.46.0-6.oe2203sp1.src.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">nghttp2-1.46.0-6.oe2203sp2.src.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">nghttp2-1.46.0-6.oe2203sp3.src.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="x86_64">
|
|
<FullProductName ProductID="nghttp2-debuginfo-1.41.0-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nghttp2-debuginfo-1.41.0-5.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-1.41.0-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">libnghttp2-1.41.0-5.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.41.0-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nghttp2-1.41.0-5.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debugsource-1.41.0-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nghttp2-debugsource-1.41.0-5.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-devel-1.41.0-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">libnghttp2-devel-1.41.0-5.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debuginfo-1.41.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">nghttp2-debuginfo-1.41.0-6.oe2003sp4.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debugsource-1.41.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">nghttp2-debugsource-1.41.0-6.oe2003sp4.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-devel-1.41.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">libnghttp2-devel-1.41.0-6.oe2003sp4.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.41.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">nghttp2-1.41.0-6.oe2003sp4.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-1.41.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">libnghttp2-1.41.0-6.oe2003sp4.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debuginfo-1.46.0-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">nghttp2-debuginfo-1.46.0-5.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-1.46.0-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">libnghttp2-1.46.0-5.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debugsource-1.46.0-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">nghttp2-debugsource-1.46.0-5.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-devel-1.46.0-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">libnghttp2-devel-1.46.0-5.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.46.0-5" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">nghttp2-1.46.0-5.oe2203.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debuginfo-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">nghttp2-debuginfo-1.46.0-6.oe2203sp1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">nghttp2-1.46.0-6.oe2203sp1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">libnghttp2-1.46.0-6.oe2203sp1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debugsource-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">nghttp2-debugsource-1.46.0-6.oe2203sp1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-devel-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">libnghttp2-devel-1.46.0-6.oe2203sp1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">libnghttp2-1.46.0-6.oe2203sp2.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debugsource-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">nghttp2-debugsource-1.46.0-6.oe2203sp2.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">nghttp2-1.46.0-6.oe2203sp2.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debuginfo-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">nghttp2-debuginfo-1.46.0-6.oe2203sp2.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-devel-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">libnghttp2-devel-1.46.0-6.oe2203sp2.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">nghttp2-1.46.0-6.oe2203sp3.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">libnghttp2-1.46.0-6.oe2203sp3.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="libnghttp2-devel-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">libnghttp2-devel-1.46.0-6.oe2203sp3.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debuginfo-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">nghttp2-debuginfo-1.46.0-6.oe2203sp3.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nghttp2-debugsource-1.46.0-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">nghttp2-debugsource-1.46.0-6.oe2203sp3.x86_64.rpm</FullProductName>
|
|
</Branch>
|
|
</ProductTree>
|
|
<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
|
|
<Notes>
|
|
<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.</Note>
|
|
</Notes>
|
|
<ReleaseDate>2024-04-12</ReleaseDate>
|
|
<CVE>CVE-2024-28182</CVE>
|
|
<ProductStatuses>
|
|
<Status Type="Fixed">
|
|
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
|
|
<ProductID>openEuler-20.03-LTS-SP4</ProductID>
|
|
<ProductID>openEuler-22.03-LTS</ProductID>
|
|
<ProductID>openEuler-22.03-LTS-SP1</ProductID>
|
|
<ProductID>openEuler-22.03-LTS-SP2</ProductID>
|
|
<ProductID>openEuler-22.03-LTS-SP3</ProductID>
|
|
</Status>
|
|
</ProductStatuses>
|
|
<Threats>
|
|
<Threat Type="Impact">
|
|
<Description>Medium</Description>
|
|
</Threat>
|
|
</Threats>
|
|
<CVSSScoreSets>
|
|
<ScoreSet>
|
|
<BaseScore>5.3</BaseScore>
|
|
<Vector>AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</Vector>
|
|
</ScoreSet>
|
|
</CVSSScoreSets>
|
|
<Remediations>
|
|
<Remediation Type="Vendor Fix">
|
|
<Description>nghttp2 security update</Description>
|
|
<DATE>2024-04-12</DATE>
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1389</URL>
|
|
</Remediation>
|
|
</Remediations>
|
|
</Vulnerability>
|
|
</cvrfdoc> |