1. Home
  2. Security Advisories
  3. Amazon Linux
  4. ALAS2-2024-2523

[ALAS2-2024-2523] Amazon Linux 2 2017.12 - ALAS2-2024-2523: important priority package update for nghttp2

Severity Important
Affected Packages 12
CVEs 1
Info Packages References Vulnerabilities

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities:
CVE-2024-28182:
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

Package Affected Version
pkg:rpm/amazonlinux/nghttp2?arch=x86_64&distro=amazonlinux-2 < 1.41.0-1.amzn2.0.5
pkg:rpm/amazonlinux/nghttp2?arch=i686&distro=amazonlinux-2 < 1.41.0-1.amzn2.0.5
pkg:rpm/amazonlinux/nghttp2?arch=aarch64&distro=amazonlinux-2 < 1.41.0-1.amzn2.0.5
pkg:rpm/amazonlinux/nghttp2-debuginfo?arch=x86_64&distro=amazonlinux-2 < 1.41.0-1.amzn2.0.5
pkg:rpm/amazonlinux/nghttp2-debuginfo?arch=i686&distro=amazonlinux-2 < 1.41.0-1.amzn2.0.5
pkg:rpm/amazonlinux/nghttp2-debuginfo?arch=aarch64&distro=amazonlinux-2 < 1.41.0-1.amzn2.0.5
pkg:rpm/amazonlinux/libnghttp2?arch=x86_64&distro=amazonlinux-2 < 1.41.0-1.amzn2.0.5
pkg:rpm/amazonlinux/libnghttp2?arch=i686&distro=amazonlinux-2 < 1.41.0-1.amzn2.0.5
pkg:rpm/amazonlinux/libnghttp2?arch=aarch64&distro=amazonlinux-2 < 1.41.0-1.amzn2.0.5
pkg:rpm/amazonlinux/libnghttp2-devel?arch=x86_64&distro=amazonlinux-2 < 1.41.0-1.amzn2.0.5
pkg:rpm/amazonlinux/libnghttp2-devel?arch=i686&distro=amazonlinux-2 < 1.41.0-1.amzn2.0.5
pkg:rpm/amazonlinux/libnghttp2-devel?arch=aarch64&distro=amazonlinux-2 < 1.41.0-1.amzn2.0.5
ID
ALAS2-2024-2523
Severity
important
URL
https://alas.aws.amazon.com/AL2/ALAS-2024-2523.html
Published
2024-04-24T22:15:00
(4 months ago)
Modified
2024-04-24T22:15:00
(4 months ago)
Rights
Amazon Linux Security Team
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/amazonlinux/nghttp2?arch=x86_64&distro=amazonlinux-2 amazonlinux nghttp2 < 1.41.0-1.amzn2.0.5 amazonlinux-2 x86_64
Affected pkg:rpm/amazonlinux/nghttp2?arch=i686&distro=amazonlinux-2 amazonlinux nghttp2 < 1.41.0-1.amzn2.0.5 amazonlinux-2 i686
Affected pkg:rpm/amazonlinux/nghttp2?arch=aarch64&distro=amazonlinux-2 amazonlinux nghttp2 < 1.41.0-1.amzn2.0.5 amazonlinux-2 aarch64
Affected pkg:rpm/amazonlinux/nghttp2-debuginfo?arch=x86_64&distro=amazonlinux-2 amazonlinux nghttp2-debuginfo < 1.41.0-1.amzn2.0.5 amazonlinux-2 x86_64
Affected pkg:rpm/amazonlinux/nghttp2-debuginfo?arch=i686&distro=amazonlinux-2 amazonlinux nghttp2-debuginfo < 1.41.0-1.amzn2.0.5 amazonlinux-2 i686
Affected pkg:rpm/amazonlinux/nghttp2-debuginfo?arch=aarch64&distro=amazonlinux-2 amazonlinux nghttp2-debuginfo < 1.41.0-1.amzn2.0.5 amazonlinux-2 aarch64
Affected pkg:rpm/amazonlinux/libnghttp2?arch=x86_64&distro=amazonlinux-2 amazonlinux libnghttp2 < 1.41.0-1.amzn2.0.5 amazonlinux-2 x86_64
Affected pkg:rpm/amazonlinux/libnghttp2?arch=i686&distro=amazonlinux-2 amazonlinux libnghttp2 < 1.41.0-1.amzn2.0.5 amazonlinux-2 i686
Affected pkg:rpm/amazonlinux/libnghttp2?arch=aarch64&distro=amazonlinux-2 amazonlinux libnghttp2 < 1.41.0-1.amzn2.0.5 amazonlinux-2 aarch64
Affected pkg:rpm/amazonlinux/libnghttp2-devel?arch=x86_64&distro=amazonlinux-2 amazonlinux libnghttp2-devel < 1.41.0-1.amzn2.0.5 amazonlinux-2 x86_64
Affected pkg:rpm/amazonlinux/libnghttp2-devel?arch=i686&distro=amazonlinux-2 amazonlinux libnghttp2-devel < 1.41.0-1.amzn2.0.5 amazonlinux-2 i686
Affected pkg:rpm/amazonlinux/libnghttp2-devel?arch=aarch64&distro=amazonlinux-2 amazonlinux libnghttp2-devel < 1.41.0-1.amzn2.0.5 amazonlinux-2 aarch64
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date