PT-2018-2561 · Nginx+4 · Nginx+4
Sam Fowler
·
Publicado
2018-11-06
·
Atualizado
2024-10-04
·
CVE-2018-16843
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
nginx versions prior to 1.15.6
nginx versions prior to 1.14.1
Description
The issue is related to the implementation of the HTTP/2 protocol in the nginx server, which can lead to uncontrolled resource consumption. This can allow a remote attacker to cause a denial of service. The problem affects nginx servers compiled with the ngx http v2 module, when the 'http2' option of the 'listen' directive is used in a configuration file.
Recommendations
For versions prior to 1.15.6, update to version 1.15.6 or later.
For versions prior to 1.14.1, update to version 1.14.1 or later.
As a temporary workaround, consider disabling the
ngx http v2 module module or removing the 'http2' option from the 'listen' directive in the configuration file until a patch is available.Correção
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Apple Macos
Nginx
Suse
Ubuntu