nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.
References
Link | Resource |
---|---|
http://www.securityfocus.com/bid/103952 | Broken Link Third Party Advisory VDB Entry |
https://access.redhat.com/errata/RHSA-2019:0366 | Third Party Advisory |
https://access.redhat.com/errata/RHSA-2019:0367 | Third Party Advisory |
https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html | Mailing List Third Party Advisory |
https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ | Vendor Advisory |
https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ | Release Notes Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
No history.
Information
Published : 2018-05-08 15:29
Updated : 2024-02-28 16:25
NVD link : CVE-2018-1000168
Mitre link : CVE-2018-1000168
CVE.ORG link : CVE-2018-1000168
JSON object : View
Products Affected
nodejs
- node.js
debian
- debian_linux
nghttp2
- nghttp2