- Vulnerability/
- USN-6754-2
USN-6754-2: nghttp2 vulnerability
First published: Tue May 07 2024(Updated: )
USN-6754-1 fixed vulnerabilities in nghttp2. This update provides the corresponding update for Ubuntu 24.04 LTS. Original advisory details: It was discovered that nghttp2 incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511, CVE-2019-9513) It was discovered that nghttp2 incorrectly handled request cancellation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487) It was discovered that nghttp2 could be made to process an unlimited number of HTTP/2 CONTINUATION frames. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. (CVE-2024-28182)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/libnghttp2-14 | <1.59.0-1ubuntu0.1 | 1.59.0-1ubuntu0.1 |
| Ubuntu | =24.04 | |
| All of | ||
| ubuntu/nghttp2 | <1.59.0-1ubuntu0.1 | 1.59.0-1ubuntu0.1 |
| Ubuntu | =24.04 | |
| All of | ||
| ubuntu/nghttp2-client | <1.59.0-1ubuntu0.1 | 1.59.0-1ubuntu0.1 |
| Ubuntu | =24.04 | |
| All of | ||
| ubuntu/nghttp2-proxy | <1.59.0-1ubuntu0.1 | 1.59.0-1ubuntu0.1 |
| Ubuntu | =24.04 | |
| All of | ||
| ubuntu/nghttp2-server | <1.59.0-1ubuntu0.1 | 1.59.0-1ubuntu0.1 |
| Ubuntu | =24.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of USN-6754-2?
The severity of USN-6754-2 is categorized as high due to a potential remote code execution vulnerability in nghttp2.
How do I fix USN-6754-2?
To fix USN-6754-2, upgrade the nghttp2 packages to version 1.59.0-1ubuntu0.1 on Ubuntu 24.04 LTS.
Which packages are affected by USN-6754-2?
The affected packages in USN-6754-2 include libnghttp2-14, nghttp2, nghttp2-client, nghttp2-proxy, and nghttp2-server.
What versions of nghttp2 are impacted by USN-6754-2?
USN-6754-2 impacts nghttp2 versions prior to 1.59.0-1ubuntu0.1.
Is a reboot required after applying the fix for USN-6754-2?
A reboot is not typically required after applying the fix for USN-6754-2, but it is advised to restart any affected services.
- agent/severity
- agent/last-modified-date
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu
- version/ubuntu/24.04