Important: nghttp2 security update
Summary
ALSA-2023:5838: Important: nghttp2 security update. Affects libnghttp2 versions < 1.43.0-5.el9_2.1. Fixed in 1.43.0-5.el9_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. It is used by various web servers to enable HTTP/2 functionality. The library provides a set of APIs for developers to incorporate HTTP/2 support into their applications. By utilizing the library, developers can take advantage of the performance improvements and features offered by the HTTP/2 protocol.
Vulnerability Detail
The nghttp2 library is susceptible to a Denial of Service (DoS) attack known as the Rapid Reset Attack. This vulnerability affects multiple web servers that have HTTP/2 enabled. An attacker can exploit this vulnerability to overwhelm the targeted server with a high volume of specially crafted HTTP/2 requests, causing the server to consume excessive resources and become unresponsive. This can lead to service disruption and potential downtime for affected web applications.
How To Fix
Minimum fixed version
1.43.0-5.el9_2.1
This is the first release that contains the fix.
sudo dnf update libnghttp2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided security update to protect the affected systems.
Conclusion
It is crucial to update the nghttp2 library to the recommended version to mitigate the Rapid Reset Attack vulnerability. By applying the provided security update, users can protect their systems from potential Denial of Service (DoS) attacks. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for libnghttp2 →
FAQ
This vulnerability allows an attacker to launch a Denial of Service (DoS) attack against web servers with HTTP/2 enabled. The attack can overwhelm the server, causing it to become unresponsive and potentially leading to service disruption and downtime for affected web applications.
Multiple web servers that have HTTP/2 enabled are vulnerable to this attack if they utilize the nghttp2 library. It is recommended to update the library on all affected servers.
While the details of the vulnerability have been disclosed, there is no known public exploit available at this time. However, it is crucial to apply the provided security update to prevent potential exploitation.
The only effective mitigation for this vulnerability is to update the nghttp2 library to the recommended version. Applying the security update will address the underlying vulnerability and protect the system from potential attacks.
You can find more information about this vulnerability, including the Common Vulnerabilities and Exposures (CVE) identifier, on the CVE page listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for libnghttp2.
