1. Home
  2. Security Advisories
  3. Ubuntu
  4. USN-6754-1

[USN-6754-1] nghttp2 vulnerabilities

Severity High
Affected Packages 35
CVEs 4
Info Packages Vulnerabilities

Several security issues were fixed in nghttp2.

It was discovered that nghttp2 incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to cause
nghttp2 to consume resources, leading to a denial of service. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511,
CVE-2019-9513)

It was discovered that nghttp2 incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause nghttp2 to consume
resources, leading to a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)

It was discovered that nghttp2 could be made to process an unlimited number
of HTTP/2 CONTINUATION frames. A remote attacker could possibly use this
issue to cause nghttp2 to consume resources, leading to a denial of
service. (CVE-2024-28182)

Package Affected Version
pkg:deb/ubuntu/nghttp2?distro=xenial < 1.7.1-1ubuntu0.1~esm2
pkg:deb/ubuntu/nghttp2?distro=mantic < 1.55.1-1ubuntu0.2
pkg:deb/ubuntu/nghttp2?distro=jammy < 1.43.0-1ubuntu0.2
pkg:deb/ubuntu/nghttp2?distro=focal < 1.40.0-1ubuntu0.3
pkg:deb/ubuntu/nghttp2?distro=bionic < 1.30.0-1ubuntu1+esm2
pkg:deb/ubuntu/nghttp2-server?distro=xenial < 1.7.1-1ubuntu0.1~esm2
pkg:deb/ubuntu/nghttp2-server?distro=mantic < 1.55.1-1ubuntu0.2
pkg:deb/ubuntu/nghttp2-server?distro=jammy < 1.43.0-1ubuntu0.2
pkg:deb/ubuntu/nghttp2-server?distro=focal < 1.40.0-1ubuntu0.3
pkg:deb/ubuntu/nghttp2-server?distro=bionic < 1.30.0-1ubuntu1+esm2
pkg:deb/ubuntu/nghttp2-proxy?distro=xenial < 1.7.1-1ubuntu0.1~esm2
pkg:deb/ubuntu/nghttp2-proxy?distro=mantic < 1.55.1-1ubuntu0.2
pkg:deb/ubuntu/nghttp2-proxy?distro=jammy < 1.43.0-1ubuntu0.2
pkg:deb/ubuntu/nghttp2-proxy?distro=focal < 1.40.0-1ubuntu0.3
pkg:deb/ubuntu/nghttp2-proxy?distro=bionic < 1.30.0-1ubuntu1+esm2
pkg:deb/ubuntu/nghttp2-client?distro=xenial < 1.7.1-1ubuntu0.1~esm2
pkg:deb/ubuntu/nghttp2-client?distro=mantic < 1.55.1-1ubuntu0.2
pkg:deb/ubuntu/nghttp2-client?distro=jammy < 1.43.0-1ubuntu0.2
pkg:deb/ubuntu/nghttp2-client?distro=focal < 1.40.0-1ubuntu0.3
pkg:deb/ubuntu/nghttp2-client?distro=bionic < 1.30.0-1ubuntu1+esm2
pkg:deb/ubuntu/libnghttp2-doc?distro=xenial < 1.7.1-1ubuntu0.1~esm2
pkg:deb/ubuntu/libnghttp2-doc?distro=mantic < 1.55.1-1ubuntu0.2
pkg:deb/ubuntu/libnghttp2-doc?distro=jammy < 1.43.0-1ubuntu0.2
pkg:deb/ubuntu/libnghttp2-doc?distro=focal < 1.40.0-1ubuntu0.3
pkg:deb/ubuntu/libnghttp2-doc?distro=bionic < 1.30.0-1ubuntu1+esm2
pkg:deb/ubuntu/libnghttp2-dev?distro=xenial < 1.7.1-1ubuntu0.1~esm2
pkg:deb/ubuntu/libnghttp2-dev?distro=mantic < 1.55.1-1ubuntu0.2
pkg:deb/ubuntu/libnghttp2-dev?distro=jammy < 1.43.0-1ubuntu0.2
pkg:deb/ubuntu/libnghttp2-dev?distro=focal < 1.40.0-1ubuntu0.3
pkg:deb/ubuntu/libnghttp2-dev?distro=bionic < 1.30.0-1ubuntu1+esm2
pkg:deb/ubuntu/libnghttp2-14?distro=xenial < 1.7.1-1ubuntu0.1~esm2
pkg:deb/ubuntu/libnghttp2-14?distro=mantic < 1.55.1-1ubuntu0.2
pkg:deb/ubuntu/libnghttp2-14?distro=jammy < 1.43.0-1ubuntu0.2
pkg:deb/ubuntu/libnghttp2-14?distro=focal < 1.40.0-1ubuntu0.3
pkg:deb/ubuntu/libnghttp2-14?distro=bionic < 1.30.0-1ubuntu1+esm2
ID
USN-6754-1
Severity
high
Severity from
CVE-2019-9511
URL
https://ubuntu.com/security/notices/USN-6754-1
Published
2024-04-25T22:23:15
(4 months ago)
Modified
2024-04-25T22:23:15
(4 months ago)
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:deb/ubuntu/nghttp2?distro=xenial ubuntu nghttp2 < 1.7.1-1ubuntu0.1~esm2 xenial
Affected pkg:deb/ubuntu/nghttp2?distro=mantic ubuntu nghttp2 < 1.55.1-1ubuntu0.2 mantic
Affected pkg:deb/ubuntu/nghttp2?distro=jammy ubuntu nghttp2 < 1.43.0-1ubuntu0.2 jammy
Affected pkg:deb/ubuntu/nghttp2?distro=focal ubuntu nghttp2 < 1.40.0-1ubuntu0.3 focal
Affected pkg:deb/ubuntu/nghttp2?distro=bionic ubuntu nghttp2 < 1.30.0-1ubuntu1+esm2 bionic
Affected pkg:deb/ubuntu/nghttp2-server?distro=xenial ubuntu nghttp2-server < 1.7.1-1ubuntu0.1~esm2 xenial
Affected pkg:deb/ubuntu/nghttp2-server?distro=mantic ubuntu nghttp2-server < 1.55.1-1ubuntu0.2 mantic
Affected pkg:deb/ubuntu/nghttp2-server?distro=jammy ubuntu nghttp2-server < 1.43.0-1ubuntu0.2 jammy
Affected pkg:deb/ubuntu/nghttp2-server?distro=focal ubuntu nghttp2-server < 1.40.0-1ubuntu0.3 focal
Affected pkg:deb/ubuntu/nghttp2-server?distro=bionic ubuntu nghttp2-server < 1.30.0-1ubuntu1+esm2 bionic
Affected pkg:deb/ubuntu/nghttp2-proxy?distro=xenial ubuntu nghttp2-proxy < 1.7.1-1ubuntu0.1~esm2 xenial
Affected pkg:deb/ubuntu/nghttp2-proxy?distro=mantic ubuntu nghttp2-proxy < 1.55.1-1ubuntu0.2 mantic
Affected pkg:deb/ubuntu/nghttp2-proxy?distro=jammy ubuntu nghttp2-proxy < 1.43.0-1ubuntu0.2 jammy
Affected pkg:deb/ubuntu/nghttp2-proxy?distro=focal ubuntu nghttp2-proxy < 1.40.0-1ubuntu0.3 focal
Affected pkg:deb/ubuntu/nghttp2-proxy?distro=bionic ubuntu nghttp2-proxy < 1.30.0-1ubuntu1+esm2 bionic
Affected pkg:deb/ubuntu/nghttp2-client?distro=xenial ubuntu nghttp2-client < 1.7.1-1ubuntu0.1~esm2 xenial
Affected pkg:deb/ubuntu/nghttp2-client?distro=mantic ubuntu nghttp2-client < 1.55.1-1ubuntu0.2 mantic
Affected pkg:deb/ubuntu/nghttp2-client?distro=jammy ubuntu nghttp2-client < 1.43.0-1ubuntu0.2 jammy
Affected pkg:deb/ubuntu/nghttp2-client?distro=focal ubuntu nghttp2-client < 1.40.0-1ubuntu0.3 focal
Affected pkg:deb/ubuntu/nghttp2-client?distro=bionic ubuntu nghttp2-client < 1.30.0-1ubuntu1+esm2 bionic
Affected pkg:deb/ubuntu/libnghttp2-doc?distro=xenial ubuntu libnghttp2-doc < 1.7.1-1ubuntu0.1~esm2 xenial
Affected pkg:deb/ubuntu/libnghttp2-doc?distro=mantic ubuntu libnghttp2-doc < 1.55.1-1ubuntu0.2 mantic
Affected pkg:deb/ubuntu/libnghttp2-doc?distro=jammy ubuntu libnghttp2-doc < 1.43.0-1ubuntu0.2 jammy
Affected pkg:deb/ubuntu/libnghttp2-doc?distro=focal ubuntu libnghttp2-doc < 1.40.0-1ubuntu0.3 focal
Affected pkg:deb/ubuntu/libnghttp2-doc?distro=bionic ubuntu libnghttp2-doc < 1.30.0-1ubuntu1+esm2 bionic
Affected pkg:deb/ubuntu/libnghttp2-dev?distro=xenial ubuntu libnghttp2-dev < 1.7.1-1ubuntu0.1~esm2 xenial
Affected pkg:deb/ubuntu/libnghttp2-dev?distro=mantic ubuntu libnghttp2-dev < 1.55.1-1ubuntu0.2 mantic
Affected pkg:deb/ubuntu/libnghttp2-dev?distro=jammy ubuntu libnghttp2-dev < 1.43.0-1ubuntu0.2 jammy
Affected pkg:deb/ubuntu/libnghttp2-dev?distro=focal ubuntu libnghttp2-dev < 1.40.0-1ubuntu0.3 focal
Affected pkg:deb/ubuntu/libnghttp2-dev?distro=bionic ubuntu libnghttp2-dev < 1.30.0-1ubuntu1+esm2 bionic
Affected pkg:deb/ubuntu/libnghttp2-14?distro=xenial ubuntu libnghttp2-14 < 1.7.1-1ubuntu0.1~esm2 xenial
Affected pkg:deb/ubuntu/libnghttp2-14?distro=mantic ubuntu libnghttp2-14 < 1.55.1-1ubuntu0.2 mantic
Affected pkg:deb/ubuntu/libnghttp2-14?distro=jammy ubuntu libnghttp2-14 < 1.43.0-1ubuntu0.2 jammy
Affected pkg:deb/ubuntu/libnghttp2-14?distro=focal ubuntu libnghttp2-14 < 1.40.0-1ubuntu0.3 focal
Affected pkg:deb/ubuntu/libnghttp2-14?distro=bionic ubuntu libnghttp2-14 < 1.30.0-1ubuntu1+esm2 bionic
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date