Univention Bugzilla – Bug 53929
nghttp2: Multiple issues (4.4)
Last modified: 2021-10-20 17:07:20 CEST
New Debian nghttp2 1.18.1-1+deb9u2 fixes: This update addresses the following issues: * Null pointer dereference when too large ALTSVC frame is received (CVE-2018-1000168) * overly large SETTINGS frames can lead to DoS (CVE-2020-11080)
--- mirror/ftp/4.4/unmaintained/4.4-2/source/nghttp2_1.18.1-1+deb9u1.dsc +++ apt/ucs_4.4-0-errata4.4-8/source/nghttp2_1.18.1-1+deb9u2.dsc @@ -1,3 +1,10 @@ +1.18.1-1+deb9u2 [Sat, 16 Oct 2021 21:06:46 +0200] Anton Gladky <gladk@debian.org>: + + * Non-maintainer upload by the LTS Security Team. + * Fix CVE-2020-11080. Implement max settings option to mitigate + denial of service. + * Fix CVE-2018-1000168. Avoid segmentation fault. + 1.18.1-1+deb9u1 [Fri, 23 Aug 2019 19:05:18 +0200] Tomasz Buchert <tomasz@debian.org>: * Fix CVE-2019-9511 and CVE-2019-9513 <http://piuparts.knut.univention.de/4.4-8/#636695621427667431>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.4-8] a1400494d3 Bug #53929: nghttp2 1.18.1-1+deb9u2 doc/errata/staging/nghttp2.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) [4.4-8] 986f4c85a1 Bug #53929: nghttp2 1.18.1-1+deb9u2 doc/errata/staging/nghttp2.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
<https://errata.software-univention.de/#/?erratum=4.4x1072>