{"schema_version":"1.7.3","id":"SUSE-SU-2021:0932-1","published":"2021-03-24T11:13:09Z","modified":"2026-02-04T03:24:08.572165Z","related":["CVE-2016-1544","CVE-2018-1000168","CVE-2019-9511","CVE-2019-9513","CVE-2020-11080"],"upstream":["CVE-2016-1544","CVE-2018-1000168","CVE-2019-9511","CVE-2019-9513","CVE-2020-11080"],"summary":"Security update for nghttp2","details":"This update for nghttp2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-11080: HTTP/2 Large Settings Frame DoS (bsc#1181358).\n- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184).\n- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146182).\n- CVE-2018-1000168: Fixed ALTSVC frame client side denial of service (bsc#1088639).\n- CVE-2016-1544: Fixed out of memory due to unlimited incoming HTTP header fields (bsc#966514).\n\nBug fixes and enhancements:\n\n- Packages must not mark license files as %doc (bsc#1082318)\n- Typo in description of libnghttp2_asio1 (bsc#962914)\n- Fixed mistake in spec file (bsc#1125689)\n- Fixed build issue with boost 1.70.0 (bsc#1134616)\n- Fixed build issue with GCC 6 (bsc#964140)\n- Feature: Add W&S module (FATE#326776, bsc#1112438)\n  ","affected":[{"package":{"name":"nghttp2","ecosystem":"SUSE:HPE Helion OpenStack 8","purl":"pkg:rpm/suse/nghttp2&distro=HPE%20Helion%20OpenStack%208"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"ecosystem_specific":{"binaries":[{"libnghttp2-14":"1.39.2-3.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0932-1.json"}},{"package":{"name":"nghttp2","ecosystem":"SUSE:OpenStack Cloud 7","purl":"pkg:rpm/suse/nghttp2&distro=SUSE%20OpenStack%20Cloud%207"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"ecosystem_specific":{"binaries":[{"libnghttp2-14":"1.39.2-3.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0932-1.json"}},{"package":{"name":"nghttp2","ecosystem":"SUSE:OpenStack Cloud 8","purl":"pkg:rpm/suse/nghttp2&distro=SUSE%20OpenStack%20Cloud%208"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"ecosystem_specific":{"binaries":[{"libnghttp2-14":"1.39.2-3.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0932-1.json"}},{"package":{"name":"nghttp2","ecosystem":"SUSE:OpenStack Cloud 9","purl":"pkg:rpm/suse/nghttp2&distro=SUSE%20OpenStack%20Cloud%209"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"ecosystem_specific":{"binaries":[{"libnghttp2-14":"1.39.2-3.5.1","libnghttp2-14-32bit":"1.39.2-3.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0932-1.json"}},{"package":{"name":"nghttp2","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","purl":"pkg:rpm/suse/nghttp2&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"ecosystem_specific":{"binaries":[{"libnghttp2-14":"1.39.2-3.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0932-1.json"}},{"package":{"name":"nghttp2","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","purl":"pkg:rpm/suse/nghttp2&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"ecosystem_specific":{"binaries":[{"libnghttp2-14":"1.39.2-3.5.1","libnghttp2-14-32bit":"1.39.2-3.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0932-1.json"}},{"package":{"name":"nghttp2","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","purl":"pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"ecosystem_specific":{"binaries":[{"libnghttp2-14":"1.39.2-3.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0932-1.json"}},{"package":{"name":"nghttp2","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","purl":"pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"ecosystem_specific":{"binaries":[{"libnghttp2-14":"1.39.2-3.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0932-1.json"}},{"package":{"name":"nghttp2","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","purl":"pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"ecosystem_specific":{"binaries":[{"libnghttp2-14":"1.39.2-3.5.1","libnghttp2-14-32bit":"1.39.2-3.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0932-1.json"}},{"package":{"name":"nghttp2","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","purl":"pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"ecosystem_specific":{"binaries":[{"libnghttp2-14":"1.39.2-3.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0932-1.json"}},{"package":{"name":"nghttp2","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","purl":"pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"ecosystem_specific":{"binaries":[{"libnghttp2-14":"1.39.2-3.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0932-1.json"}},{"package":{"name":"nghttp2","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","purl":"pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"ecosystem_specific":{"binaries":[{"libnghttp2-14":"1.39.2-3.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0932-1.json"}},{"package":{"name":"nghttp2","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","purl":"pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCL"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"ecosystem_specific":{"binaries":[{"libnghttp2-14":"1.39.2-3.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0932-1.json"}},{"package":{"name":"nghttp2","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","purl":"pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"ecosystem_specific":{"binaries":[{"libnghttp2-14":"1.39.2-3.5.1","libnghttp2-14-32bit":"1.39.2-3.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0932-1.json"}},{"package":{"name":"nghttp2","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","purl":"pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"ecosystem_specific":{"binaries":[{"libnghttp2-14":"1.39.2-3.5.1","libnghttp2-14-32bit":"1.39.2-3.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0932-1.json"}},{"package":{"name":"nghttp2","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","purl":"pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"ecosystem_specific":{"binaries":[{"libnghttp2-14":"1.39.2-3.5.1","libnghttp2-14-32bit":"1.39.2-3.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0932-1.json"}}],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210932-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1082318"},{"type":"REPORT","url":"https://bugzilla.suse.com/1088639"},{"type":"REPORT","url":"https://bugzilla.suse.com/1112438"},{"type":"REPORT","url":"https://bugzilla.suse.com/1125689"},{"type":"REPORT","url":"https://bugzilla.suse.com/1134616"},{"type":"REPORT","url":"https://bugzilla.suse.com/1146182"},{"type":"REPORT","url":"https://bugzilla.suse.com/1146184"},{"type":"REPORT","url":"https://bugzilla.suse.com/1181358"},{"type":"REPORT","url":"https://bugzilla.suse.com/962914"},{"type":"REPORT","url":"https://bugzilla.suse.com/964140"},{"type":"REPORT","url":"https://bugzilla.suse.com/966514"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-1544"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-1000168"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-9511"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-9513"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-11080"}]}