This update for nghttp2 fixes the following issues :

  - CVE-2020-11080: HTTP/2 Large Settings Frame DoS     (bsc#1181358)

This update was imported from the SUSE:SLE-15:Update update project.

Update to 14.15.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2852 advisory.

  - nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

  - nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

  - nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)

  - nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nodejs8 fixes the following issues :

  - CVE-2020-8174: Fixed multiple memory corruption in     napi_get_value_string_*() (bsc#1172443).

  - CVE-2020-11080: Fixed a potential denial of service when     receiving unreasonably large HTTP/2 SETTINGS frames     (bsc#1172442). 

  - CVE-2020-7598: Fixed an issue which could have tricked     minimist into adding or modifying properties of     Object.prototype (bsc#1166916).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2849 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (10.21.0).

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2847 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (12.18.2).

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2848 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (10.21.0).

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nghttp2 package has been released.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2524 advisory.

    Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for     installation into an on-premise OpenShift Container Platform installation.

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:2755 advisory.

  - In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
    The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of     14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at     100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement     nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of     settings entries are large (e.g., > 32), then drop the connection. (CVE-2020-11080)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the cmake package has been released.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2786 advisory.

  - nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20     vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service.
    This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in     >= 1.31.1. (CVE-2018-1000168)

  - In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
    The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of     14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at     100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement     nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of     settings entries are large (e.g., > 32), then drop the connection. (CVE-2020-11080)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
148159	openSUSE Security Update : nghttp2 (openSUSE-2021-468)	Nessus	SuSE Local Security Checks	2021/3/26	2024/1/8	high
144124	Fedora 33 : 1:nodejs (2020-43d5a372fc)	Nessus	Fedora Local Security Checks	2020/12/14	2024/2/2	high
145951	CentOS 8 : nodejs:12 (CESA-2020:2852)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/24	high
138680	openSUSE Security Update : nodejs8 (openSUSE-2020-802)	Nessus	SuSE Local Security Checks	2020/7/20	2024/2/29	high
138156	RHEL 8 : nodejs:10 (RHSA-2020:2849)	Nessus	Red Hat Local Security Checks	2020/7/7	2024/11/7	high
138169	RHEL 8 : nodejs:12 (RHSA-2020:2847)	Nessus	Red Hat Local Security Checks	2020/7/7	2024/11/7	high
138172	RHEL 8 : nodejs:10 (RHSA-2020:2848)	Nessus	Red Hat Local Security Checks	2020/7/7	2025/3/13	high
137876	Photon OS 1.0: Nghttp2 PHSA-2020-1.0-0304	Nessus	PhotonOS Local Security Checks	2020/6/29	2022/12/5	high
137335	RHEL 8 : Red Hat OpenShift Service Mesh 1.0 servicemesh-proxy (RHSA-2020:2524)	Nessus	Red Hat Local Security Checks	2020/6/11	2024/11/7	high
157635	AlmaLinux 8 : nghttp2 (ALSA-2020:2755)	Nessus	Alma Linux Local Security Checks	2022/2/9	2022/12/5	high
204458	Photon OS 5.0: Cmake PHSA-2023-5.0-0035	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	critical
154195	Debian DLA-2786-1 : nghttp2 - LTS security update	Nessus	Debian Local Security Checks	2021/10/17	2022/12/5	high
203988	Photon OS 3.0: Nodejs PHSA-2023-3.0-0606	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high

検出

プラグインの検索

high

high

high

high

high

high

high

high

high

high

critical

high

high