Bug 1644510 (CVE-2018-16844)

Summary: CVE-2018-16844 nginx: Excessive CPU usage via flaw in HTTP/2 implementation
Product: [Other] Security Response Reporter: Sam Fowler <sfowler>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abhgupta, affix, athmanem, bperkins, dajohnso, dbaker, dmetzger, gblomqui, gmainwar, gmccullo, gtanzill, hhorak, jamielinux, jeremy, jfrey, jhardy, jkaluza, jlaska, jokerman, jorton, jprause, kdixon, luhliari, obarenbo, pavel.lisy, peter, roliveri, security-response-team, simaishi, sthangav, tadej.j, trankin, wtogami
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: nginx 1.15.6, nginx 1.14.1 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:41:22 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1647260, 1648222, 1647258, 1647262, 1648224, 1648225, 1650093, 1650094    
Bug Blocks: 1644513    

Description Sam Fowler 2018-10-31 04:07:20 UTC
nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage.

Comment 1 Borja Tarraso 2018-11-02 08:48:00 UTC
Acknowledgments:

Name: the Nginx project

Comment 2 Borja Tarraso 2018-11-02 15:08:29 UTC
Ansible Tower is not enabling neither using http2 within the nginx configuration file, so it is not affected.

Comment 3 Borja Tarraso 2018-11-02 20:11:10 UTC
Already did some research and discuss with Satoe I. from CloudForms. CFME is not using in any way nginx more than the inclusion from Ansible Tower (not changed or altered configuration or used outside from Tower), and Ansible Tower is not affected, so CloudForms is also not affected; updating the task accordingly.

Comment 4 Sam Fowler 2018-11-07 00:35:10 UTC
External Reference:

http://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html

Comment 5 Sam Fowler 2018-11-07 00:36:17 UTC
Created nginx tracking bugs for this issue:

Affects: epel-all [bug 1647260]
Affects: fedora-all [bug 1647258]

Comment 8 Riccardo Schirone 2018-11-08 10:12:50 UTC
Upstream patch:
http://hg.nginx.org/nginx/rev/9200b41db765

Comment 9 Riccardo Schirone 2018-11-08 11:41:07 UTC
Statement:

This issue did not affect the versions of rh-nginx18-nginx as shipped with Red Hat Software Collections as they did not include the vulnerable module ngx_http_v2_module.

Comment 11 errata-xmlrpc 2018-11-27 09:03:05 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2018:3680 https://access.redhat.com/errata/RHSA-2018:3680

Comment 12 errata-xmlrpc 2018-11-27 09:17:24 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2018:3681 https://access.redhat.com/errata/RHSA-2018:3681