PT-2018-2561 · Nginx+4 · Nginx+4

Sam Fowler · Published 2018-11-06 · Updated 2024-10-04 · CVE-2018-16843

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions nginx versions prior to 1.15.6 nginx versions prior to 1.14.1

Description The issue is related to the implementation of the HTTP/2 protocol in the nginx server, which can lead to uncontrolled resource consumption. This can allow a remote attacker to cause a denial of service. The problem affects nginx servers compiled with the ngx http v2 module, when the 'http2' option of the 'listen' directive is used in a configuration file.

Recommendations For versions prior to 1.15.6, update to version 1.15.6 or later. For versions prior to 1.14.1, update to version 1.14.1 or later. As a temporary workaround, consider disabling the ngx http v2 module module or removing the 'http2' option from the 'listen' directive in the configuration file until a patch is available.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2018-2601

BDU:2019-00982

CVE-2018-16843

DSA-4335-1

MGASA-2018-0459

OPENSUSE-SU-2019:0195-1

OPENSUSE-SU-2019:2120-1

OPENSUSE-SU-2019_0195-1

OPENSUSE-SU-2019_2120-1

OPENSUSE-SU-2024:11092-1

RHSA-2018:3653

RHSA-2018:3680

RHSA-2018:3681

SUSE-SU-2019:0334-1

SUSE-SU-2019:2309-1

SUSE-SU-2019_0334-1

SUSE-SU-2019_2309-1

USN-3812-1

Affected Products

Alt Linux

Apple Macos

Nginx

Suse

Ubuntu

References · 88

• https://bdu.fstec.ru/vul/2019-00983 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16843 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16843 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16843 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3812-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2309-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16845 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16845 · Security Note
• https://security-tracker.debian.org/tracker/source-package/nginx · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03782 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-16843 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00984 · Security Note
• https://usn.ubuntu.com/3812-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2120-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4335-1 · Vendor Advisory