Bug 1644511 (CVE-2018-16843) - CVE-2018-16843 nginx: Excessive memory consumption via flaw in HTTP/2 implementation
Summary: CVE-2018-16843 nginx: Excessive memory consumption via flaw in HTTP/2 impleme...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-16843
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1647259 1647261 1647263 1648226 1648227 1648228 1650088 1650091 1650092
Blocks: 1644513
TreeView+ depends on / blocked
 
Reported: 2018-10-31 04:08 UTC by Sam Fowler
Modified: 2021-02-16 22:50 UTC (History)
35 users (show)

Fixed In Version: nginx 1.15.6, nginx 1.14.1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-10 10:41:24 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:3653 0 None None None 2018-11-26 12:26:47 UTC
Red Hat Product Errata RHSA-2018:3680 0 None None None 2018-11-27 09:03:38 UTC
Red Hat Product Errata RHSA-2018:3681 0 None None None 2018-11-27 09:18:07 UTC

Description Sam Fowler 2018-10-31 04:08:34 UTC 
nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption.
Comment 1 Borja Tarraso 2018-11-02 08:48:03 UTC 
Acknowledgments:

Name: the Nginx project
Comment 2 Borja Tarraso 2018-11-02 15:09:10 UTC 
Ansible Tower is not enabling neither using http2 within the nginx configuration file, so it is not affected.
Comment 3 Borja Tarraso 2018-11-02 20:11:20 UTC 
Already did some research and discuss with Satoe I. from CloudForms. CFME is not using in any way nginx more than the inclusion from Ansible Tower (not changed or altered configuration or used outside from Tower), and Ansible Tower is not affected, so CloudForms is also not affected; updating the task accordingly.
Comment 4 Sam Fowler 2018-11-07 00:35:08 UTC 
External Reference:

http://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html
Comment 5 Sam Fowler 2018-11-07 00:36:19 UTC 
Created nginx tracking bugs for this issue:

Affects: epel-all [bug 1647261]
Affects: fedora-all [bug 1647259]
Comment 8 Riccardo Schirone 2018-11-08 10:13:15 UTC 
Upstream patch:
http://hg.nginx.org/nginx/rev/1c6b6163c039
Comment 9 Riccardo Schirone 2018-11-08 11:41:15 UTC 
Statement:

This issue did not affect the versions of rh-nginx18-nginx as shipped with Red Hat Software Collections as they did not include the vulnerable module ngx_http_v2_module.
Comment 11 errata-xmlrpc 2018-11-26 12:26:37 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6

Via RHSA-2018:3653 https://access.redhat.com/errata/RHSA-2018:3653
Comment 12 errata-xmlrpc 2018-11-27 09:03:21 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2018:3680 https://access.redhat.com/errata/RHSA-2018:3680
Comment 13 errata-xmlrpc 2018-11-27 09:17:46 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2018:3681 https://access.redhat.com/errata/RHSA-2018:3681
Note You need to log in before you can comment on or make changes to this bug.