CVE-2020-11080

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

References

https://github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394

https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr

https://github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090

https://www.debian.org/security/2020/dsa-4696

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html

https://lists.fedoraproject.org/archives/list/[email protected]/message/AAC2AA36OTRHKSVM5OV7TTVB3CZIGEFL/

https://www.oracle.com/security-alerts/cpujul2020.html

https://www.oracle.com/security-alerts/cpuoct2020.html

https://lists.fedoraproject.org/archives/list/[email protected]/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/

https://www.oracle.com/security-alerts/cpujan2021.html

https://www.oracle.com//security-alerts/cpujul2021.html

https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html

Details

Source: MITRE

Published: 2020-06-03

Updated: 2021-10-17

Type: CWE-707

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact Score: 3.6

Exploitability Score: 3.9

Severity: HIGH

Tenable Plugins

View all (41 total)

IDNameProductFamilySeverity
154195Debian DLA-2786-1 : nghttp2 - LTS security updateNessusDebian Local Security Checks
high
148357Photon OS 4.0: Mysql PHSA-2021-4.0-0007NessusPhotonOS Local Security Checks
high
148164SUSE SLES12 Security Update : nghttp2 (SUSE-SU-2021:0932-1) (Data Dribble) (Resource Loop)NessusSuSE Local Security Checks
high
148159openSUSE Security Update : nghttp2 (openSUSE-2021-468)NessusSuSE Local Security Checks
high
148149SUSE SLED15 / SLES15 Security Update : nghttp2 (SUSE-SU-2021:0930-1)NessusSuSE Local Security Checks
high
148143SUSE SLES15 Security Update : nghttp2 (SUSE-SU-2021:0931-1)NessusSuSE Local Security Checks
high
145951CentOS 8 : nodejs:12 (CESA-2020:2852)NessusCentOS Local Security Checks
high
145879CentOS 8 : nghttp2 (CESA-2020:2755)NessusCentOS Local Security Checks
high
145804CentOS 8 : nodejs:10 (CESA-2020:2848)NessusCentOS Local Security Checks
high
144124Fedora 33 : 1:nodejs (2020-43d5a372fc)NessusFedora Local Security Checks
high
143610SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2020:2800-1)NessusSuSE Local Security Checks
high
140014EulerOS Virtualization for ARM 64 3.0.6.0 : nghttp2 (EulerOS-SA-2020-1911)NessusHuawei Local Security Checks
high
138482Oracle Linux 8 : nodejs:12 (ELSA-2020-2852)NessusOracle Linux Local Security Checks
high
138481Oracle Linux 8 : nodejs:10 (ELSA-2020-2848)NessusOracle Linux Local Security Checks
high
139145EulerOS 2.0 SP8 : nghttp2 (EulerOS-SA-2020-1815)NessusHuawei Local Security Checks
high
139085Amazon Linux AMI : nghttp2 (ALAS-2020-1404)NessusAmazon Linux Local Security Checks
high
138801RHEL 8 : nodejs:10 (RHSA-2020:3042)NessusRed Hat Local Security Checks
high
138680openSUSE Security Update : nodejs8 (openSUSE-2020-802)NessusSuSE Local Security Checks
high
138384RHEL 8 : nodejs:12 (RHSA-2020:2852)NessusRed Hat Local Security Checks
high
138172RHEL 8 : nodejs:10 (RHSA-2020:2848)NessusRed Hat Local Security Checks
high
138170RHEL 8 : nghttp2 (RHSA-2020:2850)NessusRed Hat Local Security Checks
high
138169RHEL 8 : nodejs:12 (RHSA-2020:2847)NessusRed Hat Local Security Checks
high
138156RHEL 8 : nodejs:10 (RHSA-2020:2849)NessusRed Hat Local Security Checks
high
138146RHEL 8 : nghttp2 (RHSA-2020:2823)NessusRed Hat Local Security Checks
high
138047Amazon Linux 2 : nghttp2 (ALAS-2020-1445)NessusAmazon Linux Local Security Checks
high
137896RHEL 8 : nghttp2 (RHSA-2020:2755)NessusRed Hat Local Security Checks
high
137876Photon OS 1.0: Nghttp2 PHSA-2020-1.0-0304NessusPhotonOS Local Security Checks
high
137871Oracle Linux 8 : nghttp2 (ELSA-2020-2755)NessusOracle Linux Local Security Checks
high
137778Photon OS 3.0: Nghttp2 PHSA-2020-3.0-0105NessusPhotonOS Local Security Checks
high
137718Photon OS 2.0: Nghttp2 PHSA-2020-2.0-0254NessusPhotonOS Local Security Checks
high
137705RHEL 6 / 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP3 (RHSA-2020:2644)NessusRed Hat Local Security Checks
medium
137618SUSE SLES12 Security Update : nodejs12 (SUSE-SU-2020:1606-1)NessusSuSE Local Security Checks
high
137603SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2020:1576-1)NessusSuSE Local Security Checks
high
137602SUSE SLES12 Security Update : nodejs10 (SUSE-SU-2020:1575-1)NessusSuSE Local Security Checks
high
137597SUSE SLES15 Security Update : nodejs10 (SUSE-SU-2020:1568-1)NessusSuSE Local Security Checks
high
137576Fedora 31 : nghttp2 (2020-f7d15c8b77)NessusFedora Local Security Checks
high
137382FreeBSD : Node.js -- June 2020 Security Releases (11fcfa8f-ac64-11ea-9dab-000d3ab229d6)NessusFreeBSD Local Security Checks
high
137335RHEL 8 : Red Hat OpenShift Service Mesh 1.0 servicemesh-proxy (RHSA-2020:2524)NessusRed Hat Local Security Checks
high
137330RHEL 8 : Red Hat OpenShift Service Mesh 1.1.2 servicemesh-proxy (RHSA-2020:2523)NessusRed Hat Local Security Checks
high
137208Debian DSA-4696-1 : nodejs - security updateNessusDebian Local Security Checks
high
137126FreeBSD : nghttp2 -- DoS vulnerability (4bb56d2f-a5b0-11ea-a860-08002728f74c)NessusFreeBSD Local Security Checks
high