DSA-5570: -1 nghttp2 -- security update

Published Dec 1, 2023

Updated

It was discovered that libnghttp2, a library implementing the HTTP/2 protocol, handled request cancellation incorrectly. This could result in denial of service.

Affected Software

2 affected componentsFixes available

debian/nghttp2

1.52.0-1+deb12u3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/nghttp2 to a version that resolves this vulnerability.
Fixed in 1.52.0-1+deb12u3
Upgrade
Upgrade nghttp2 to a version that resolves this vulnerability.
Patch DSA-5570-1

Event History

Dec 1, 2023

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2023-44487

Frequently Asked Questions

What is DSA-5570?

DSA-5570 is a security update for the nghttp2 library in Debian.

What is the vulnerability in DSA-5570?

The vulnerability in DSA-5570 is related to how libnghttp2 handles request cancellation, which can result in denial of service.

How does the vulnerability in DSA-5570 affect nghttp2?

The vulnerability affects the nghttp2 library, which is responsible for implementing the HTTP/2 protocol.

How can I fix the vulnerability in DSA-5570?

To fix the vulnerability in DSA-5570, you should update the nghttp2 library to the latest version.

Where can I find more information about DSA-5570?

More information about DSA-5570 can be found on the Debian security tracker page and the Debian security advisory page.