NVD Vulnerability Detail

CVE-2018-1000168

Summary	nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.
Publication Date	May 9, 2018, 12:29 a.m.
Registration Date	March 1, 2021, 6:39 p.m.
Last Update	Nov. 21, 2024, 12:39 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:nghttp2:nghttp2::::::::		1.10.0	1.31.0

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:9.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/103952	Broken Link Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/103952	Broken Link Third Party Advisory VDB Entry
3	https://access.redhat.com/errata/RHSA-2019:0366	Third Party Advisory
4	https://access.redhat.com/errata/RHSA-2019:0366	Third Party Advisory
5	https://access.redhat.com/errata/RHSA-2019:0367	Third Party Advisory
6	https://access.redhat.com/errata/RHSA-2019:0367	Third Party Advisory
7	https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html	Mailing List Third Party Advisory
8	https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html	Mailing List Third Party Advisory
9	https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/	Vendor Advisory
10	https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/	Vendor Advisory
11	https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/	Release Notes Third Party Advisory
12	https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/	Release Notes Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html
2	CWE-476	NULL ポインタデリファレンス	https://cwe.mitre.org/data/definitions/476.html

JVN Vulnerability Information

nghttp2 における入力確認に関する脆弱性

Title	nghttp2 における入力確認に関する脆弱性
Summary	nghttp2 には、入力確認に関する脆弱性、およびNULL ポインタデリファレンスに関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 12, 2018, midnight
Registration Date	June 27, 2018, 5:05 p.m.
Last Update	June 27, 2018, 5:05 p.m.

Affected System

nghttp2 project

nghttp2 1.10.0 以上 1.31.0 以下

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-1000168	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000168
National Vulnerability Database (NVD)
2	CVE-2018-1000168	https://nvd.nist.gov/vuln/detail/CVE-2018-1000168

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html
2	CWE-476	http://cwe.mitre.org/data/definitions/476.html

ベンダー情報

No	Name	URL
nghttp2
1	Nghttp2 v1.31.1	https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/

Change Log

No	Changed Details	Date of change
1	[2018年06月27日] 掲載	June 27, 2018, 5:05 p.m.