NULL pointer dereference in nghttp2 - CVE-2018-1000168

Vulnerability identifier: #VU11858

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1000168

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The weakness exists due to improper bounds checking. If an alternative services (ALTSVC) frame is too large, the pointer field that points to the ALTSVC frame payload is left NULL. A remote attacker can submit a large ALTSVC frame, trigger a NULL pointer dereference and cause the service to crash.

nghttp2
Fedora
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
Opensuse
nodejs (Alpine package)
nghttp2
libnghttp2-14
libnghttp2-14-32bit
libnghttp2-14-debuginfo
libnghttp2-14-debuginfo-32bit
nghttp2-debuginfo
nghttp2-debugsource

Update to version 1.31.1.

nodejs (Alpine package) - update to 8.11.3-r0
nghttp2 - addressed in versions 1.31.1-1.el7, 1.31.1-1.fc27, 1.31.1-1.fc28
libnghttp2-14 - update to 1.39.2-3.5.1
libnghttp2-14-32bit - update to 1.39.2-3.5.1
libnghttp2-14-debuginfo - update to 1.39.2-3.5.1
libnghttp2-14-debuginfo-32bit - update to 1.39.2-3.5.1
nghttp2-debuginfo - update to 1.39.2-3.5.1
nghttp2-debugsource - update to 1.39.2-3.5.1

• https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/

• Denial of service in nghttp2
• OpenSUSE Linux update for nodejs8
• NULL pointer dereference in nodejs (Alpine package)
• SUSE update for nghttp2
• Fedora 28 update for nghttp2
• Fedora EPEL 7 update for nghttp2
• Fedora 27 update for nghttp2