Affected: AlmaLinux:8: nginx, AlmaLinux:8: nginx-all-modules, AlmaLinux:8: nginx-filesystem, AlmaLinux:8: nginx-mod-http-image-filter, AlmaLinux:8: nginx-mod-http-perl, AlmaLinux:8: nginx-mod-http-xslt-filter, AlmaLinux:8: nginx-mod-mail, AlmaLinux:8: nginx-mod-stream

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 (Post Office Protocol 3) and IMAP protocols, with a focus on high concurrency, performance and low memory usage.

Security Fix(es):

* HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511)

* HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513)

* HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Withdrawn by the publisher.

Withdrawn by the publisher.

Affected: CleanStart: nginx

Multiple security vulnerabilities affect the nginx package. When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. See references for individual vulnerability details.

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

Security update for nodejs10

HTTP/2: large amount of data requests leads to denial of service HTTP/2: flood using PRIORITY frames results in excessive resource consumption HTTP/2: 0-length headers lead to denial of service

Security update for Mozilla Firefox

Affected: Ubuntu:16.04:LTS: nginx, Ubuntu:18.04:LTS: nginx

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in nginx ausnutzen, um einen Denial of Service Angriff durchzuführen.