Bug 1644510 (CVE-2018-16844)
| Summary: | CVE-2018-16844 nginx: Excessive CPU usage via flaw in HTTP/2 implementation | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Sam Fowler <sfowler> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abhgupta, affix, athmanem, bperkins, cmoore, dajohnso, dbaker, dmetzger, gblomqui, gmainwar, gmccullo, gtanzill, hhorak, jeremy, jfrey, jhardy, jkaluza, jlaska, jokerman, jorton, jprause, kaycoth, kdixon, kwalsh, luhliari, obarenbo, pavel.lisy, peter.borsa, roliveri, security-response-team, simaishi, sthangav, tadej.j, trankin, wtogami |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | nginx 1.15.6, nginx 1.14.1 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-10 10:41:22 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1647258, 1647260, 1647262, 1648222, 1648224, 1648225, 1650093, 1650094, 1888169 | ||
| Bug Blocks: | 1644513 | ||
|
Description
Sam Fowler
2018-10-31 04:07:20 UTC
Acknowledgments: Name: the Nginx project Ansible Tower is not enabling neither using http2 within the nginx configuration file, so it is not affected. Already did some research and discuss with Satoe I. from CloudForms. CFME is not using in any way nginx more than the inclusion from Ansible Tower (not changed or altered configuration or used outside from Tower), and Ansible Tower is not affected, so CloudForms is also not affected; updating the task accordingly. External Reference: http://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html Created nginx tracking bugs for this issue: Affects: epel-all [bug 1647260] Affects: fedora-all [bug 1647258] Upstream patch: http://hg.nginx.org/nginx/rev/9200b41db765 Statement: This issue did not affect the versions of rh-nginx18-nginx as shipped with Red Hat Software Collections as they did not include the vulnerable module ngx_http_v2_module. This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2018:3680 https://access.redhat.com/errata/RHSA-2018:3680 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2018:3681 https://access.redhat.com/errata/RHSA-2018:3681 |