[openSUSE-SU-2021:0468-1] Security update for nghttp2

Severity Important

Affected Packages 14

CVEs 1

Security update for nghttp2

This update for nghttp2 fixes the following issues:

CVE-2020-11080: HTTP/2 Large Settings Frame DoS (bsc#1181358)

This update was imported from the SUSE:SLE-15:Update update project.

Package	Affected Version
pkg:rpm/opensuse/python3-nghttp2?arch=x86_64&distro=opensuse-leap-15.2	< 1.40.0-lp152.2.6.1
pkg:rpm/opensuse/python3-nghttp2?arch=i586&distro=opensuse-leap-15.2	< 1.40.0-lp152.2.6.1
pkg:rpm/opensuse/nghttp2?arch=x86_64&distro=opensuse-leap-15.2	< 1.40.0-lp152.2.6.1
pkg:rpm/opensuse/nghttp2?arch=i586&distro=opensuse-leap-15.2	< 1.40.0-lp152.2.6.1
pkg:rpm/opensuse/libnghttp2_asio1?arch=x86_64&distro=opensuse-leap-15.2	< 1.40.0-lp152.2.6.1
pkg:rpm/opensuse/libnghttp2_asio1?arch=i586&distro=opensuse-leap-15.2	< 1.40.0-lp152.2.6.1
pkg:rpm/opensuse/libnghttp2_asio1-32bit?arch=x86_64&distro=opensuse-leap-15.2	< 1.40.0-lp152.2.6.1
pkg:rpm/opensuse/libnghttp2_asio-devel?arch=x86_64&distro=opensuse-leap-15.2	< 1.40.0-lp152.2.6.1
pkg:rpm/opensuse/libnghttp2_asio-devel?arch=i586&distro=opensuse-leap-15.2	< 1.40.0-lp152.2.6.1
pkg:rpm/opensuse/libnghttp2-devel?arch=x86_64&distro=opensuse-leap-15.2	< 1.40.0-lp152.2.6.1
pkg:rpm/opensuse/libnghttp2-devel?arch=i586&distro=opensuse-leap-15.2	< 1.40.0-lp152.2.6.1
pkg:rpm/opensuse/libnghttp2-14?arch=x86_64&distro=opensuse-leap-15.2	< 1.40.0-lp152.2.6.1
pkg:rpm/opensuse/libnghttp2-14?arch=i586&distro=opensuse-leap-15.2	< 1.40.0-lp152.2.6.1
pkg:rpm/opensuse/libnghttp2-14-32bit?arch=x86_64&distro=opensuse-leap-15.2	< 1.40.0-lp152.2.6.1

ID

openSUSE-SU-2021:0468-1

Severity

important

URL

https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3FQEUDKQEBT4RUZ2JLDQBWSAYUJ4SCTW/

Published

2021-03-25T08:10:28
(3 years ago)

Modified

2021-03-25T08:10:28
(3 years ago)

Rights

Other Advisories

Source	Name	URL
Suse	SUSE ratings	https://www.suse.com/support/security/rating/
Suse	URL of this CSAF notice	https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0468-1.json
Suse	URL for openSUSE-SU-2021:0468-1	https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3FQEUDKQEBT4RUZ2JLDQBWSAYUJ4SCTW/
Suse	E-Mail link for openSUSE-SU-2021:0468-1	https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3FQEUDKQEBT4RUZ2JLDQBWSAYUJ4SCTW/
Bugzilla	SUSE Bug 1172442	https://bugzilla.suse.com/1172442
Bugzilla	SUSE Bug 1181358	https://bugzilla.suse.com/1181358
CVE	SUSE CVE CVE-2020-11080 page	https://www.suse.com/security/cve/CVE-2020-11080/

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch
Affected	pkg:rpm/opensuse/python3-nghttp2?arch=x86_64&distro=opensuse-leap-15.2	opensuse	python3-nghttp2	< 1.40.0-lp152.2.6.1	opensuse-leap-15.2	x86_64
Affected	pkg:rpm/opensuse/python3-nghttp2?arch=i586&distro=opensuse-leap-15.2	opensuse	python3-nghttp2	< 1.40.0-lp152.2.6.1	opensuse-leap-15.2	i586
Affected	pkg:rpm/opensuse/nghttp2?arch=x86_64&distro=opensuse-leap-15.2	opensuse	nghttp2	< 1.40.0-lp152.2.6.1	opensuse-leap-15.2	x86_64
Affected	pkg:rpm/opensuse/nghttp2?arch=i586&distro=opensuse-leap-15.2	opensuse	nghttp2	< 1.40.0-lp152.2.6.1	opensuse-leap-15.2	i586
Affected	pkg:rpm/opensuse/libnghttp2_asio1?arch=x86_64&distro=opensuse-leap-15.2	opensuse	libnghttp2_asio1	< 1.40.0-lp152.2.6.1	opensuse-leap-15.2	x86_64
Affected	pkg:rpm/opensuse/libnghttp2_asio1?arch=i586&distro=opensuse-leap-15.2	opensuse	libnghttp2_asio1	< 1.40.0-lp152.2.6.1	opensuse-leap-15.2	i586
Affected	pkg:rpm/opensuse/libnghttp2_asio1-32bit?arch=x86_64&distro=opensuse-leap-15.2	opensuse	libnghttp2_asio1-32bit	< 1.40.0-lp152.2.6.1	opensuse-leap-15.2	x86_64
Affected	pkg:rpm/opensuse/libnghttp2_asio-devel?arch=x86_64&distro=opensuse-leap-15.2	opensuse	libnghttp2_asio-devel	< 1.40.0-lp152.2.6.1	opensuse-leap-15.2	x86_64
Affected	pkg:rpm/opensuse/libnghttp2_asio-devel?arch=i586&distro=opensuse-leap-15.2	opensuse	libnghttp2_asio-devel	< 1.40.0-lp152.2.6.1	opensuse-leap-15.2	i586
Affected	pkg:rpm/opensuse/libnghttp2-devel?arch=x86_64&distro=opensuse-leap-15.2	opensuse	libnghttp2-devel	< 1.40.0-lp152.2.6.1	opensuse-leap-15.2	x86_64
Affected	pkg:rpm/opensuse/libnghttp2-devel?arch=i586&distro=opensuse-leap-15.2	opensuse	libnghttp2-devel	< 1.40.0-lp152.2.6.1	opensuse-leap-15.2	i586
Affected	pkg:rpm/opensuse/libnghttp2-14?arch=x86_64&distro=opensuse-leap-15.2	opensuse	libnghttp2-14	< 1.40.0-lp152.2.6.1	opensuse-leap-15.2	x86_64
Affected	pkg:rpm/opensuse/libnghttp2-14?arch=i586&distro=opensuse-leap-15.2	opensuse	libnghttp2-14	< 1.40.0-lp152.2.6.1	opensuse-leap-15.2	i586
Affected	pkg:rpm/opensuse/libnghttp2-14-32bit?arch=x86_64&distro=opensuse-leap-15.2	opensuse	libnghttp2-14-32bit	< 1.40.0-lp152.2.6.1	opensuse-leap-15.2	x86_64

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date