Important: nghttp2 security update
Summary
ALSA-2023:6746: Important: nghttp2 security update. Affects libnghttp2 versions < 1.43.0-5.el9_3.1. Fixed in 1.43.0-5.el9_3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. It is used by various web servers to enable HTTP/2 functionality. The library provides a set of APIs for developers to incorporate HTTP/2 support into their applications. However, a vulnerability has been discovered in nghttp2 that could potentially lead to a Distributed Denial of Service (DDoS) attack.
Vulnerability Detail
The vulnerability, known as the Rapid Reset Attack, affects multiple web servers that have HTTP/2 enabled. An attacker can exploit this vulnerability to launch a DDoS attack by sending specially crafted HTTP/2 requests. This can overwhelm the server and cause it to become unresponsive, denying service to legitimate users. The impact of this vulnerability can be severe, leading to service disruption and potential financial losses for affected organizations.
How To Fix
Minimum fixed version
1.43.0-5.el9_3.1
This is the first release that contains the fix.
sudo dnf update libnghttp2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible to protect against potential attacks.
Conclusion
In conclusion, the nghttp2 library is vulnerable to the Rapid Reset Attack, which can be exploited to launch DDoS attacks. It is crucial to update to the latest version of nghttp2 to mitigate this vulnerability and protect your systems. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libnghttp2 →
FAQ
nghttp2 is a library that implements the HTTP/2 protocol in C. It allows web servers and applications to support the latest version of the HTTP protocol, providing improved performance and features.
The Rapid Reset Attack is a vulnerability in nghttp2 that allows an attacker to launch a DDoS attack by sending specially crafted HTTP/2 requests. This can overwhelm the server and cause it to become unresponsive.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any known vulnerabilities.
No, only versions prior to 1.43.0-5.el9_3.1 are affected by this vulnerability. It is crucial to update to the latest version to ensure the security of your system.
The Rapid Reset Attack can lead to a DDoS attack, causing service disruption and potentially impacting the availability of web servers and applications. This can result in financial losses and damage to the reputation of affected organizations.
Related vulnerabilities
Recent vulnerabilities recorded for libnghttp2.
