ID CVE-2018-1000168
Summary nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.
References
Vulnerable Configurations
  • nghttp2 1.10.0
    cpe:2.3:a:nghttp2:nghttp2:1.10.0
  • nghttp2 1.11.0
    cpe:2.3:a:nghttp2:nghttp2:1.11.0
  • nghttp2 1.11.1
    cpe:2.3:a:nghttp2:nghttp2:1.11.1
  • nghttp2 1.12.0
    cpe:2.3:a:nghttp2:nghttp2:1.12.0
  • nghttp2 1.13.0
    cpe:2.3:a:nghttp2:nghttp2:1.13.0
  • nghttp2 1.14.0
    cpe:2.3:a:nghttp2:nghttp2:1.14.0
  • nghttp2 1.14.1
    cpe:2.3:a:nghttp2:nghttp2:1.14.1
  • nghttp2 1.15.0
    cpe:2.3:a:nghttp2:nghttp2:1.15.0
  • nghttp2 1.16.0
    cpe:2.3:a:nghttp2:nghttp2:1.16.0
  • nghttp2 1.16.1
    cpe:2.3:a:nghttp2:nghttp2:1.16.1
  • nghttp2 1.17.0
    cpe:2.3:a:nghttp2:nghttp2:1.17.0
  • nghttp2 1.18.0
    cpe:2.3:a:nghttp2:nghttp2:1.18.0
  • nghttp2 1.18.1
    cpe:2.3:a:nghttp2:nghttp2:1.18.1
  • nghttp2 1.19.0
    cpe:2.3:a:nghttp2:nghttp2:1.19.0
  • nghttp2 1.20.0
    cpe:2.3:a:nghttp2:nghttp2:1.20.0
  • nghttp2 1.21.0
    cpe:2.3:a:nghttp2:nghttp2:1.21.0
  • nghttp2 1.21.1
    cpe:2.3:a:nghttp2:nghttp2:1.21.1
  • nghttp2 1.22.0
    cpe:2.3:a:nghttp2:nghttp2:1.22.0
  • nghttp2 1.23.0
    cpe:2.3:a:nghttp2:nghttp2:1.23.0
  • nghttp2 1.23.1
    cpe:2.3:a:nghttp2:nghttp2:1.23.1
  • nghttp2 1.24.0
    cpe:2.3:a:nghttp2:nghttp2:1.24.0
  • nghttp2 1.25.0
    cpe:2.3:a:nghttp2:nghttp2:1.25.0
  • nghttp2 1.26.0
    cpe:2.3:a:nghttp2:nghttp2:1.26.0
  • nghttp2 1.27.0
    cpe:2.3:a:nghttp2:nghttp2:1.27.0
  • nghttp2 1.28.0
    cpe:2.3:a:nghttp2:nghttp2:1.28.0
  • nghttp2 1.29.0
    cpe:2.3:a:nghttp2:nghttp2:1.29.0
  • nghttp2 1.30.0
    cpe:2.3:a:nghttp2:nghttp2:1.30.0
  • nghttp2 1.31.0
    cpe:2.3:a:nghttp2:nghttp2:1.31.0
  • nodejs Node.js 8.4.0
    cpe:2.3:a:nodejs:node.js:8.4.0
  • Nodejs Node.js 8.5.0
    cpe:2.3:a:nodejs:node.js:8.5.0
  • nodejs Node.js 8.6.0
    cpe:2.3:a:nodejs:node.js:8.6.0
  • nodejs Node.js 8.7.0
    cpe:2.3:a:nodejs:node.js:8.7.0
  • Nodejs Node.js 8.8.0
    cpe:2.3:a:nodejs:node.js:8.8.0
  • Nodejs Node.js 8.8.1
    cpe:2.3:a:nodejs:node.js:8.8.1
  • Nodejs Node.js 8.9.0
    cpe:2.3:a:nodejs:node.js:8.9.0
  • Nodejs Node.js 8.9.0 LTS Edition
    cpe:2.3:a:nodejs:node.js:8.9.0:-:-:-:lts
  • Nodejs Node.js 8.9.1
    cpe:2.3:a:nodejs:node.js:8.9.1
  • Nodejs Node.js 8.9.1 LTS Edition
    cpe:2.3:a:nodejs:node.js:8.9.1:-:-:-:lts
  • Nodejs Node.js 8.9.2
    cpe:2.3:a:nodejs:node.js:8.9.2
  • Nodejs Node.js 8.9.2 LTS Edition
    cpe:2.3:a:nodejs:node.js:8.9.2:-:-:-:lts
  • Nodejs Node.js 8.9.3
    cpe:2.3:a:nodejs:node.js:8.9.3
  • Nodejs Node.js 8.9.3 LTS Edition
    cpe:2.3:a:nodejs:node.js:8.9.3:-:-:-:lts
  • Nodejs Node.js 8.9.4
    cpe:2.3:a:nodejs:node.js:8.9.4
  • Nodejs Node.js 8.9.4 LTS Edition
    cpe:2.3:a:nodejs:node.js:8.9.4:-:-:-:lts
  • Nodejs Node.js 8.10.0
    cpe:2.3:a:nodejs:node.js:8.10.0
  • Nodejs Node.js 8.10.0 LTS Edition
    cpe:2.3:a:nodejs:node.js:8.10.0:-:-:-:lts
  • Nodejs Node.js 8.11.0
    cpe:2.3:a:nodejs:node.js:8.11.0
  • Nodejs Node.js 8.11.1
    cpe:2.3:a:nodejs:node.js:8.11.1
  • Nodejs Node.js 8.11.1 LTS Edition
    cpe:2.3:a:nodejs:node.js:8.11.1:-:-:-:lts
  • Nodejs Node.js 8.11.2
    cpe:2.3:a:nodejs:node.js:8.11.2
  • Nodejs Node.js 8.11.2 LTS Edition
    cpe:2.3:a:nodejs:node.js:8.11.2:-:-:-:lts
  • Nodejs Node.js 8.11.3
    cpe:2.3:a:nodejs:node.js:8.11.3
  • Nodejs Node.js 8.11.3 LTS Edition
    cpe:2.3:a:nodejs:node.js:8.11.3:-:-:-:lts
  • Nodejs Node.js 8.11.4 LTS Edition
    cpe:2.3:a:nodejs:node.js:8.11.4:-:-:-:lts
  • Nodejs Node.js 8.12.0 LTS Edition
    cpe:2.3:a:nodejs:node.js:8.12.0:-:-:-:lts
  • Nodejs Node.js 8.13.0 LTS Edition
    cpe:2.3:a:nodejs:node.js:8.13.0:-:-:-:lts
  • Nodejs Node.js 8.14.0 LTS Edition
    cpe:2.3:a:nodejs:node.js:8.14.0:-:-:-:lts
  • Nodejs Node.js 8.14.1 LTS Edition
    cpe:2.3:a:nodejs:node.js:8.14.1:-:-:-:lts
  • Nodejs Node.js 8.15.0 LTS Edition
    cpe:2.3:a:nodejs:node.js:8.15.0:-:-:-:lts
  • Nodejs Node.js 8.15.1
    cpe:2.3:a:nodejs:node.js:8.15.1
  • Nodejs Node.js 8.15.1 LTS Edition
    cpe:2.3:a:nodejs:node.js:8.15.1:-:-:-:lts
  • Nodejs Node.js 9.0.0
    cpe:2.3:a:nodejs:node.js:9.0.0
  • Nodejs Node.js 9.1.0
    cpe:2.3:a:nodejs:node.js:9.1.0
  • Nodejs Node.js 9.2.0
    cpe:2.3:a:nodejs:node.js:9.2.0
  • Nodejs Node.js 9.2.1
    cpe:2.3:a:nodejs:node.js:9.2.1
  • Nodejs Node.js 9.3.0
    cpe:2.3:a:nodejs:node.js:9.3.0
  • Nodejs Node.js 9.4.0
    cpe:2.3:a:nodejs:node.js:9.4.0
  • Nodejs Node.js 9.5.0
    cpe:2.3:a:nodejs:node.js:9.5.0
  • Nodejs Node.js 9.6.0
    cpe:2.3:a:nodejs:node.js:9.6.0
  • Nodejs Node.js 9.6.1
    cpe:2.3:a:nodejs:node.js:9.6.1
  • Nodejs Node.js 9.7.0
    cpe:2.3:a:nodejs:node.js:9.7.0
  • Nodejs Node.js 9.7.1
    cpe:2.3:a:nodejs:node.js:9.7.1
  • Nodejs Node.js 9.8.0
    cpe:2.3:a:nodejs:node.js:9.8.0
  • Nodejs Node.js 9.9.0
    cpe:2.3:a:nodejs:node.js:9.9.0
  • Nodejs Node.js 9.10.0
    cpe:2.3:a:nodejs:node.js:9.10.0
  • Nodejs Node.js 9.10.1
    cpe:2.3:a:nodejs:node.js:9.10.1
  • Nodejs Node.js 9.11.0
    cpe:2.3:a:nodejs:node.js:9.11.0
  • Nodejs Node.js 9.11.1
    cpe:2.3:a:nodejs:node.js:9.11.1
  • Nodejs Node.js 9.11.2
    cpe:2.3:a:nodejs:node.js:9.11.2
  • Nodejs Node.js 10.0.0
    cpe:2.3:a:nodejs:node.js:10.0.0
  • Nodejs Node.js 10.1.0
    cpe:2.3:a:nodejs:node.js:10.1.0
  • Nodejs Node.js 10.2.0
    cpe:2.3:a:nodejs:node.js:10.2.0
  • Nodejs Node.js 10.2.1
    cpe:2.3:a:nodejs:node.js:10.2.1
  • Nodejs Node.js 10.3.0
    cpe:2.3:a:nodejs:node.js:10.3.0
  • Nodejs Node.js 10.4.0
    cpe:2.3:a:nodejs:node.js:10.4.0
  • Nodejs Node.js 10.4.1
    cpe:2.3:a:nodejs:node.js:10.4.1
  • Nodejs Node.js 10.5.0
    cpe:2.3:a:nodejs:node.js:10.5.0
  • Nodejs Node.js 10.6.0
    cpe:2.3:a:nodejs:node.js:10.6.0
  • Nodejs Node.js 10.7.0
    cpe:2.3:a:nodejs:node.js:10.7.0
  • Nodejs Node.js 10.8.0
    cpe:2.3:a:nodejs:node.js:10.8.0
  • Nodejs Node.js 10.9.0
    cpe:2.3:a:nodejs:node.js:10.9.0
  • Nodejs Node.js 10.10.0
    cpe:2.3:a:nodejs:node.js:10.10.0
  • Nodejs Node.js 10.11.0
    cpe:2.3:a:nodejs:node.js:10.11.0
  • Nodejs Node.js 10.12.0
    cpe:2.3:a:nodejs:node.js:10.12.0
  • Nodejs Node.js 10.13.0 LTS Edition
    cpe:2.3:a:nodejs:node.js:10.13.0:-:-:-:lts
  • Nodejs Node.js 10.14.0 LTS Edition
    cpe:2.3:a:nodejs:node.js:10.14.0:-:-:-:lts
  • Nodejs Node.js 10.14.1 LTS Edition
    cpe:2.3:a:nodejs:node.js:10.14.1:-:-:-:lts
  • Nodejs Node.js 10.14.2 LTS Edition
    cpe:2.3:a:nodejs:node.js:10.14.2:-:-:-:lts
  • Nodejs Node.js 10.15.0 LTS Edition
    cpe:2.3:a:nodejs:node.js:10.15.0:-:-:-:lts
  • Nodejs Node.js 10.15.1 LTS Edition
    cpe:2.3:a:nodejs:node.js:10.15.1:-:-:-:lts
  • Nodejs Node.js 10.15.2
    cpe:2.3:a:nodejs:node.js:10.15.2
  • Nodejs Node.js 10.15.2 LTS Edition
    cpe:2.3:a:nodejs:node.js:10.15.2:-:-:-:lts
CVSS
Base: 5.0
Impact:
Exploitability:
CWE CWE-476
CAPEC
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1918-1.NASL
    description This update for nodejs8 to version 8.11.3 fixes the following issues: These security issues were fixed : - CVE-2018-7167: Calling Buffer.fill() or Buffer.alloc() with some parameters could have lead to a hang which could have resulted in a DoS (bsc#1097375). - CVE-2018-7161: By interacting with the http2 server in a manner that triggered a cleanup bug where objects are used in native code after they are no longer available an attacker could have caused a denial of service (DoS) by causing a node server providing an http2 server to crash (bsc#1097404). - CVE-2018-1000168: Fixed a denial of service vulnerability by unbundling nghttp2 (bsc#1097401) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 120038
    published 2019-01-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=120038
    title SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2018:1918-1)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2018-CEC96A9C41.NASL
    description - update to the latest upstream release (fixes CVE-2018-1000168) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-05
    plugin id 109226
    published 2018-04-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109226
    title Fedora 27 : nghttp2 (2018-cec96a9c41)
  • NASL family Misc.
    NASL id NODEJS_2018_JUL.NASL
    description The version of Node.js installed on the remote host is 6.x prior to 6.14.3, 8.x prior to 8.11.3, 9.x prior to 9.11.2 or 10.x prior to 10.4.1. It, therefore, is affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-11-14
    plugin id 118957
    published 2018-11-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=118957
    title Node.js multiple vulnerabilities (July 2018 Security Releases).
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_1FCCB25E8451438CA2B96A021E4D7A31.NASL
    description nghttp2 blog : If ALTSVC frame is received by libnghttp2 and it is larger than it can accept, the pointer field which points to ALTSVC frame payload is left NULL. Later libnghttp2 attempts to access another field through the pointer, and gets segmentation fault. ALTSVC frame is defined by RFC 7838. The largest frame size libnghttp2 accept is by default 16384 bytes. Receiving ALTSVC frame is disabled by default. Application has to enable it explicitly by calling nghttp2_option_set_builtin_recv_extension_type(opt, NGHTTP2_ALTSVC). Transmission of ALTSVC is always enabled, and it does not cause this vulnerability. ALTSVC frame is expected to be sent by server, and received by client as defined in RFC 7838. Client and server are both affected by this vulnerability if the reception of ALTSVC frame is enabled. As written earlier, it is useless to enable reception of ALTSVC frame on server side. So, server is generally safe unless application accidentally enabled the reception of ALTSVC frame.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109050
    published 2018-04-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109050
    title FreeBSD : nghttp2 -- Denial of service due to NULL pointer dereference (1fccb25e-8451-438c-a2b9-6a021e4d7a31)
  • NASL family PhotonOS Local Security Checks
    NASL id PHOTONOS_PHSA-2018-1_0-0150_NGHTTP2.NASL
    description An update of the nghttp2 package has been released.
    last seen 2019-02-08
    modified 2019-02-07
    plugin id 121850
    published 2019-02-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=121850
    title Photon OS 1.0: Nghttp2 PHSA-2018-1.0-0150
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2019-0367.NASL
    description An update is now available for JBoss Core Services on RHEL 6 and RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.29 Service Pack 1 serves as an update to Red Hat JBoss Core Services Apache HTTP Server 2.4.29, and includes bug fixes for CVEs which are linked to in the References section. Security Fixes : * httpd: DoS for HTTP/2 connections by continuous SETTINGS (CVE-2018-11763) * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312) * httpd: Out of bound access after failure in reading the HTTP request (CVE-2018-1301) * httpd: Use-after-free on HTTP/2 stream shutdown (CVE-2018-1302) * httpd: bypass with a trailing newline in the file name (CVE-2017-15715) * httpd: Out of bound write in mod_authnz_ldap when using too small Accept-Language values (CVE-2017-15710) * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause a denial of service (CVE-2018-1303) * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI applications (CVE-2018-1283) * httpd: mod_http2: too much time allocated to workers, possibly leading to DoS (CVE-2018-1333) * mod_jk: connector path traversal due to mishandled HTTP requests in httpd (CVE-2018-11759) * nghttp2: NULL pointer dereference when too large ALTSVC frame is received (CVE-2018-1000168) * openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service (CVE-2018-0739) Details around each issue, including information about the CVE, severity of the issue, and the CVSS score, can be found on the CVE pages listed in the Reference section below.
    last seen 2019-02-21
    modified 2019-02-19
    plugin id 122292
    published 2019-02-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=122292
    title RHEL 6 / 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 (RHSA-2019:0367)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2018-BDEFA5E5BB.NASL
    description - update to the latest upstream release (fixes CVE-2018-1000168) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-01-03
    plugin id 120750
    published 2019-01-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=120750
    title Fedora 28 : nghttp2 (2018-bdefa5e5bb)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2018-724.NASL
    description This update for nodejs8 to version 8.11.3 fixes the following issues : These security issues were fixed : - CVE-2018-7167: Calling Buffer.fill() or Buffer.alloc() with some parameters could have lead to a hang which could have resulted in a DoS (bsc#1097375). - CVE-2018-7161: By interacting with the http2 server in a manner that triggered a cleanup bug where objects are used in native code after they are no longer available an attacker could have caused a denial of service (DoS) by causing a node server providing an http2 server to crash (bsc#1097404). - CVE-2018-1000168: Fixed a denial of service vulnerability by unbundling nghttp2 (bsc#1097401) This update was imported from the SUSE:SLE-15:Update update project.
    last seen 2019-02-21
    modified 2018-09-04
    plugin id 111095
    published 2018-07-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111095
    title openSUSE Security Update : nodejs8 (openSUSE-2018-724)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_45B8E2EB705611E88FAB63CA6E0E13A2.NASL
    description Node.js reports : Denial of Service Vulnerability in HTTP/2 (CVE-2018-7161) All versions of 8.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation. Thanks to Jordan Zebor at F5 Networks for reporting this issue. Denial of Service, nghttp2 dependency (CVE-2018-1000168) All versions of 9.x and later are vulnerable and the severity is HIGH. Under certain conditions, a malicious client can trigger an uninitialized read (and a subsequent segfault) by sending a malformed ALTSVC frame. This has been addressed through an by updating nghttp2. Denial of Service Vulnerability in TLS (CVE-2018-7162) All versions of 9.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation. Thanks to Jordan Zebor at F5 Networks all of his help investigating this issue with the Node.js team. Memory exhaustion DoS on v9.x (CVE-2018-7164) Versions 9.7.0 and later are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour. Calls to Buffer.fill() and/or Buffer.alloc() may hang (CVE-2018-7167) Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 110539
    published 2018-06-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110539
    title FreeBSD : node.js -- multiple vulnerabilities (45b8e2eb-7056-11e8-8fab-63ca6e0e13a2)
  • NASL family Amazon Linux Local Security Checks
    NASL id AL2_ALAS-2018-1020.NASL
    description nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1. (CVE-2018-1000168)
    last seen 2019-02-21
    modified 2018-08-31
    plugin id 110193
    published 2018-05-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110193
    title Amazon Linux 2 : nghttp2 (ALAS-2018-1020)
  • NASL family PhotonOS Local Security Checks
    NASL id PHOTONOS_PHSA-2018-1_0-0150.NASL
    description An update of {'gcc', 'nghttp2'} packages of Photon OS has been released.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 111276
    published 2018-07-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111276
    title Photon OS 1.0 : gcc / nghttp2 (PhotonOS-PHSA-2018-1.0-0150 (deprecated)
redhat via4
advisories
  • rhsa
    id RHSA-2019:0366
  • rhsa
    id RHSA-2019:0367
refmap via4
bid 103952
confirm
Last major update 08-05-2018 - 11:29
Published 08-05-2018 - 11:29
Last modified 05-03-2019 - 08:58
Back to Top