Security update for nginx SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2019:2264-1 Final 1 1 2019-10-06T09:57:45Z current 2019-10-06T09:57:45Z 2019-10-06T09:57:45Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nginx This update for nginx fixes the following issues: Security issues fixed: - CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579). - CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580). - CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582). This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2019-2264 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html E-Mail link for openSUSE-SU-2019:2264-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1145579 SUSE Bug 1145579 https://bugzilla.suse.com/1145580 SUSE Bug 1145580 https://bugzilla.suse.com/1145582 SUSE Bug 1145582 https://www.suse.com/security/cve/CVE-2019-9511/ SUSE CVE CVE-2019-9511 page https://www.suse.com/security/cve/CVE-2019-9513/ SUSE CVE CVE-2019-9513 page https://www.suse.com/security/cve/CVE-2019-9516/ SUSE CVE CVE-2019-9516 page openSUSE Leap 15.0 nginx-1.14.2-lp150.2.11.1 vim-plugin-nginx-1.14.2-lp150.2.11.1 nginx-1.14.2-lp150.2.11.1 as a component of openSUSE Leap 15.0 vim-plugin-nginx-1.14.2-lp150.2.11.1 as a component of openSUSE Leap 15.0 Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. CVE-2019-9511 openSUSE Leap 15.0:nginx-1.14.2-lp150.2.11.1 openSUSE Leap 15.0:vim-plugin-nginx-1.14.2-lp150.2.11.1 important 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html https://www.suse.com/security/cve/CVE-2019-9511.html CVE-2019-9511 https://bugzilla.suse.com/1145579 SUSE Bug 1145579 https://bugzilla.suse.com/1146091 SUSE Bug 1146091 https://bugzilla.suse.com/1146182 SUSE Bug 1146182 https://bugzilla.suse.com/1193427 SUSE Bug 1193427 https://bugzilla.suse.com/1202787 SUSE Bug 1202787 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU. CVE-2019-9513 openSUSE Leap 15.0:nginx-1.14.2-lp150.2.11.1 openSUSE Leap 15.0:vim-plugin-nginx-1.14.2-lp150.2.11.1 important 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html https://www.suse.com/security/cve/CVE-2019-9513.html CVE-2019-9513 https://bugzilla.suse.com/1145580 SUSE Bug 1145580 https://bugzilla.suse.com/1146094 SUSE Bug 1146094 https://bugzilla.suse.com/1146184 SUSE Bug 1146184 https://bugzilla.suse.com/1193427 SUSE Bug 1193427 https://bugzilla.suse.com/1202787 SUSE Bug 1202787 Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory. CVE-2019-9516 openSUSE Leap 15.0:nginx-1.14.2-lp150.2.11.1 openSUSE Leap 15.0:vim-plugin-nginx-1.14.2-lp150.2.11.1 important 6.8 AV:N/AC:L/Au:S/C:N/I:N/A:C 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html https://www.suse.com/security/cve/CVE-2019-9516.html CVE-2019-9516 https://bugzilla.suse.com/1145582 SUSE Bug 1145582 https://bugzilla.suse.com/1146090 SUSE Bug 1146090 https://bugzilla.suse.com/1193427 SUSE Bug 1193427