nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.
References
Link | Resource |
---|---|
http://www.securityfocus.com/bid/103952 | Broken Link Third Party Advisory VDB Entry |
https://access.redhat.com/errata/RHSA-2019:0366 | Third Party Advisory |
https://access.redhat.com/errata/RHSA-2019:0367 | Third Party Advisory |
https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html | Mailing List Third Party Advisory |
https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ | Vendor Advisory |
https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ | Release Notes Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2018-05-08T15:00:00
Updated: 2021-10-17T07:06:17
Reserved: 2018-04-09T00:00:00
Link: CVE-2018-1000168
JSON object: View
NVD Information
Status : Analyzed
Published: 2018-05-08T15:29:00.207
Modified: 2022-08-16T13:01:03.207
Link: CVE-2018-1000168
JSON object: View
Redhat Information
No data.