MGASA-2020-0256

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2020-0256.html
Import Source
https://advisories.mageia.org/MGASA-2020-0256.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2020-0256
Related
Published
2020-06-10T23:59:36Z
Modified
2020-06-10T23:28:28Z
Summary
Updated nghttp2 packages fix security vulnerability
Details

nghttp2 has been updated to version 1.41.0 to fix CVE-2020-11080.

The overly large HTTP/2 SETTINGS frame payload causes denial of service.

The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%.

References
Credits

Affected packages

Mageia:7 / nghttp2

Package

Name
nghttp2
Purl
pkg:rpm/mageia/nghttp2?distro=mageia-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.41.0-1.mga7

Ecosystem specific 

{
    "section": "core"
}