Affected: AlmaLinux:8: nginx, AlmaLinux:8: nginx-all-modules, AlmaLinux:8: nginx-filesystem, AlmaLinux:8: nginx-mod-http-image-filter, AlmaLinux:8: nginx-mod-http-perl, AlmaLinux:8: nginx-mod-http-xslt-filter, AlmaLinux:8: nginx-mod-mail, AlmaLinux:8: nginx-mod-stream

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 (Post Office Protocol 3) and IMAP protocols, with a focus on high concurrency, performance and low memory usage.

Security Fix(es):

* HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511)

* HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513)

* HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Withdrawn by the publisher.

Affected: CleanStart: nghttp2

Security vulnerability affects the nghttp2 package. Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.

Security update for nodejs10

HTTP/2: large amount of data requests leads to denial of service HTTP/2: flood using PRIORITY frames results in excessive resource consumption HTTP/2: 0-length headers lead to denial of service

Security update for Mozilla Firefox

Affected: Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:16.04:LTS: nginx, Ubuntu:Pro:16.04:LTS: nghttp2, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:18.04:LTS: nginx, Ubuntu:Pro:18.04:LTS: nghttp2, Ubuntu:Pro:18.04:LTS: nodejs

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in nginx ausnutzen, um einen Denial of Service Angriff durchzuführen.