CVE-2019-9514
published 2019-08-13CVE-2019-9514: Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an…
PriorityP358high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
82.81%
99.6th percentile
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
Affected
75 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | traffic_server | 6.0.0 – 6.2.3 | — |
| apache | traffic_server | 7.0.0 – 7.1.6 | — |
| apache | traffic_server | 8.0.0 – 8.0.3 | — |
| apple | swiftnio | 1.0.0 – 1.4.0 | — |
| apple | swiftnio_http_2 | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | h2o | < h2o 2.2.5+dfsg2-3 (bookworm) | h2o 2.2.5+dfsg2-3 (bookworm) |
| debian | nodejs | < h2o 2.2.5+dfsg2-3 (bookworm) | h2o 2.2.5+dfsg2-3 (bookworm) |
| debian | rust-h2 | < h2o 2.2.5+dfsg2-3 (bookworm) | h2o 2.2.5+dfsg2-3 (bookworm) |
| debian | trafficserver | < h2o 2.2.5+dfsg2-3 (bookworm) | h2o 2.2.5+dfsg2-3 (bookworm) |
| f5 | big-ip_local_traffic_manager | >= 11.6.1 < 11.6.5.1 | 11.6.5.1 |
| f5 | big-ip_local_traffic_manager | >= 12.1.0 < 12.1.5.1 | 12.1.5.1 |
| f5 | big-ip_local_traffic_manager | >= 13.1.0 < 13.1.3.2 | 13.1.3.2 |
| f5 | big-ip_local_traffic_manager | >= 14.0.0 < 14.0.1.1 | 14.0.1.1 |
| f5 | big-ip_local_traffic_manager | >= 14.1.0 < 14.1.2.1 | 14.1.2.1 |
| f5 | big-ip_local_traffic_manager | >= 15.0.0 < 15.0.1.1 | 15.0.1.1 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| golang.org | x_net | >= 0 < 0.0.0-20190813141303-74dc4d7220e7 | 0.0.0-20190813141303-74dc4d7220e7 |
| h2o | h2o | >= 0 < 2.2.5+dfsg2-3 | 2.2.5+dfsg2-3 |
| h2o | h2o | >= 0 < 2.2.5+dfsg2-3 | 2.2.5+dfsg2-3 |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert tcp-pkt any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET DOS Possible Microsoft Windows HTTP2 Reset Flood Denial of Service Inbound (CVE-2019-9514)"; flow:established,to_server; dsize:9; content:"|00 00 00 01 04 00 00 00|"; startswith; fast_pattern; threshold:type threshold, count 45, seconds 60, track by_src; reference:cve,2019-9514; classtype:denial-of-service; sid:2034093; rev:1; metadata:attack_target Server, created_at 2021_10_04, cve CVE_2019_9514, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, updated_at 2021_10_04, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
bytes
|00 00 00 01 04 00 00 00|
- →Detect HTTP/2 RST_STREAM reset flood: match TCP payload of exactly 9 bytes starting with the byte sequence |00 00 00 01 04 00 00 00|, threshold 45 occurrences per 60 seconds per source IP, inbound to servers.
- →The attack pattern involves opening many HTTP/2 streams and sending invalid requests to elicit RST_STREAM frames from the peer; monitor for abnormally high RST_STREAM frame rates from a single client. ↗
- →On Windows IIS/HTTP.sys, monitor registry key HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters for the presence or modification of Http2MaxServerResetsPerMinute, Http2MaxResetsPerStream, and related HTTP/2 throttle values, which are added by the patch and left unconfigured by default. ↗
- →A HTTP/2 server experiencing this attack may show unbounded memory or CPU growth; correlate with high RST_STREAM or HEADERS frame counts using HEADERS frames with invalid HTTP headers. ↗
- ·On Windows, the HTTP/2 throttling registry values (Http2MaxServerResetsPerMinute, Http2MaxResetsPerStream, Http2MaxPingsPerMinute, etc.) are added by the patch but are OFF by default; administrators must explicitly configure them to be protected. ↗
- ·The Snort/ET rule threshold (45 resets in 60 seconds per source) is a heuristic and may need tuning per environment to avoid false positives or missed detections.
- ·golang and nodejs packages have no available mitigation at time of advisory; both packages require upstream fixes before patching is possible. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Reset flood in net/http and golang.org/x/net/http
osv·2022-08-01
CVE-2019-9512 Reset flood in net/http and golang.org/x/net/http
Reset flood in net/http and golang.org/x/net/http
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
OSV
golang.org/x/net/http vulnerable to ping floods
osv·2022-05-24
CVE-2019-9512 [HIGH] golang.org/x/net/http vulnerable to ping floods
golang.org/x/net/http vulnerable to ping floods
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
### Specific Go Packages Affected
golang.org/x/net/http2
GHSA
golang.org/x/net/http vulnerable to a reset flood
ghsa·2022-05-24
CVE-2019-9514 [HIGH] CWE-400 golang.org/x/net/http vulnerable to a reset flood
golang.org/x/net/http vulnerable to a reset flood
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
### Specific Go Packages Affected
golang.org/x/net/http2
OSV
golang.org/x/net/http vulnerable to a reset flood
osv·2022-05-24
CVE-2019-9512 [HIGH] golang.org/x/net/http vulnerable to a reset flood
golang.org/x/net/http vulnerable to a reset flood
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
### Specific Go Packages Affected
golang.org/x/net/http2
OSV
HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
osv·2022-03-14·CVSS 7.5
CVE-2019-9512 [HIGH] HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
### Impact
Twisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities:
Ping flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512
Reset flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514
Settings flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9515
A Twisted web server supports HTTP/2 requests if you've installed the [`http2` optional dependency set](https://twistedmatrix.com/documents/19.2.0/installation/howto/optional.html).
### Workarounds
There are no workarounds.
### References
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
### For more information
If you have any question
GHSA
HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
ghsa·2022-03-14·CVSS 7.5
CVE-2019-9512 [HIGH] HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
### Impact
Twisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities:
Ping flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512
Reset flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514
Settings flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9515
A Twisted web server supports HTTP/2 requests if you've installed the [`http2` optional dependency set](https://twistedmatrix.com/documents/19.2.0/installation/howto/optional.html).
### Workarounds
There are no workarounds.
### References
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
### For more information
If you have any question
OSV
netty vulnerabilities
osv·2021-06-29·CVSS 7.5
CVE-2019-9512 [HIGH] netty vulnerabilities
netty vulnerabilities
It was discovered that Netty incorrectly implements HTTP/2. An attacker
could possibly use this issue to cause a denial of service. (CVE-2019-9512,
CVE-2019-9514, CVE-2019-9515, CVE-2019-9518)
OSV
twisted vulnerabilities
osv·2020-03-19·CVSS 6.1
CVE-2019-12387 [MEDIUM] twisted vulnerabilities
twisted vulnerabilities
it was discovered that Twisted incorrectly validated or sanitized certain
URIs or HTTP methods. A remote attacker could use this issue to inject
invalid characters and possibly perform header injection attacks.
(CVE-2019-12387)
It was discovered that Twisted incorrectly verified XMPP TLS certificates.
A remote attacker could possibly use this issue to perform a
machine-in-the-middle attack and obtain sensitive information. (CVE-2019-12855)
It was discovered that Twisted incorrectly handled HTTP/2 connections. A
remote attacker could possibly use this issue to cause Twisted to hang or
consume resources, leading to a denial of service. This issue only affected
Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-9512, CVE-2019-9514,
CVE-2019-9515)
Jake Miller and ZeddYu L
OSV
CVE-2019-9514: Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
osv·2019-08-13·CVSS 7.5
CVE-2019-9514 [HIGH] CVE-2019-9514: Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
Ubuntu
Netty vulnerabilities
vendor_ubuntu·2021-06-29·CVSS 7.5
CVE-2019-9514 [HIGH] Netty vulnerabilities
Title: Netty vulnerabilities
Summary: Several security issues were fixed in Netty.
It was discovered that Netty incorrectly implements HTTP/2. An attacker
could possibly use this issue to cause a denial of service. (CVE-2019-9512,
CVE-2019-9514, CVE-2019-9515, CVE-2019-9518)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Twisted vulnerabilities
vendor_ubuntu·2020-03-19·CVSS 6.1
CVE-2019-12387 [MEDIUM] Twisted vulnerabilities
Title: Twisted vulnerabilities
Summary: Several security issues were fixed in Twisted.
it was discovered that Twisted incorrectly validated or sanitized certain
URIs or HTTP methods. A remote attacker could use this issue to inject
invalid characters and possibly perform header injection attacks.
(CVE-2019-12387)
It was discovered that Twisted incorrectly verified XMPP TLS certificates.
A remote attacker could possibly use this issue to perform a
machine-in-the-middle attack and obtain sensitive information. (CVE-2019-12855)
It was discovered that Twisted incorrectly handled HTTP/2 connections. A
remote attacker could possibly use this issue to cause Twisted to hang or
consume resources, leading to a denial of service. This issue only affected
Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-20
Red Hat
HTTP/2: flood using HEADERS frames results in unbounded memory growth
vendor_redhat·2019-08-13·CVSS 7.5
CVE-2019-9514 [HIGH] CWE-400 HTTP/2: flood using HEADERS frames results in unbounded memory growth
HTTP/2: flood using HEADERS frames results in unbounded memory growth
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
A flaw was found in HTTP/2. Using HEADER frames with invalid HTTP headers and queuing of response RST_STREAM frames, an attacker could cause a flood resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability.
Statement: The golang package in Red Hat OpenStack Platform 9 Operational Tools will not be updated for this flaw
Apple
CVE-2019-9514: SwiftNIO HTTP/2 1.5.0
vendor_apple·2019-08-13·CVSS 7.5
CVE-2019-9514 [HIGH] CVE-2019-9514: SwiftNIO HTTP/2 1.5.0
Apple Security Update: About the security content of SwiftNIO HTTP/2 1.5.0
Product: SwiftNIO HTTP/2
Version: 1.5.0
CVE: CVE-2019-9514
Component: SwiftNIO HTTP/2
Impact: A HTTP/2 server may consume unbounded amounts of memory when receiving certain traffic patterns and eventually suffer resource exhaustion
Description: This issue was addressed with improved buffer size management.
Microsoft
HTTP/2 Server Denial of Service Vulnerability
vendor_msrc·2019-08-13·CVSS 7.5
CVE-2019-9514 [HIGH] HTTP/2 Server Denial of Service Vulnerability
HTTP/2 Server Denial of Service Vulnerability
Description: A denial of service vulnerability exists in the HTTP/2 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP/2 requests. An attacker who successfully exploited the vulnerability could create a denial of service condition, causing the target system to become unresponsive.
To exploit this vulnerability, an unauthenticated attacker could send a specially crafted HTTP packet to a target system, causing the affected system to become nonresponsive.
The update addresses the vulnerability by modifying how the Windows HTTP protocol stack handles HTTP/2 requests. Note that the denial of service vulnerability would not allow an attacker to execute code or to elevate user rights.
FAQ: After I install the HTTP/2 upd
Debian
CVE-2019-9514: h2o - Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading...
vendor_debian·2019·CVSS 7.5
CVE-2019-9514 [HIGH] CVE-2019-9514: h2o - Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading...
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
Scope: local
bookworm: resolved (fixed in 2.2.5+dfsg2-3)
bullseye: resolved (fixed in 2.2.5+dfsg2-3)
Suricata
ET DOS Possible Microsoft Windows HTTP2 Reset Flood Denial of Service Inbound (CVE-2019-9514)
suricata·2021-10-04·CVSS 7.5
CVE-2019-9514 [HIGH] ET DOS Possible Microsoft Windows HTTP2 Reset Flood Denial of Service Inbound (CVE-2019-9514)
ET DOS Possible Microsoft Windows HTTP2 Reset Flood Denial of Service Inbound (CVE-2019-9514)
Rule: alert tcp-pkt any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET DOS Possible Microsoft Windows HTTP2 Reset Flood Denial of Service Inbound (CVE-2019-9514)"; flow:established,to_server; dsize:9; content:"|00 00 00 01 04 00 00 00|"; startswith; fast_pattern; threshold:type threshold, count 45, seconds 60, track by_src; reference:cve,2019-9514; classtype:denial-of-service; sid:2034093; rev:1; metadata:attack_target Server, created_at 2021_10_04, cve CVE_2019_9514, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, updated_at 2021_10_04, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Expl
No public exploits indexed.
Bugzilla
CVE-2019-9514 undertow: HTTP/2: flood using HEADERS frames results in unbounded memory growth [fedora-all]
bugzilla·2019-09-03·CVSS 7.5
CVE-2019-9514 [HIGH] CVE-2019-9514 undertow: HTTP/2: flood using HEADERS frames results in unbounded memory growth [fedora-all]
CVE-2019-9514 undertow: HTTP/2: flood using HEADERS frames results in unbounded memory growth [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affect
Bugzilla
CVE-2019-9514 kubernetes: HTTP/2: flood using HEADERS frames results in unbounded memory growth [fedora-all]
bugzilla·2019-08-26·CVSS 7.5
CVE-2019-9514 [HIGH] CVE-2019-9514 kubernetes: HTTP/2: flood using HEADERS frames results in unbounded memory growth [fedora-all]
CVE-2019-9514 kubernetes: HTTP/2: flood using HEADERS frames results in unbounded memory growth [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affe
Bugzilla
CVE-2019-9514 nodejs: HTTP/2: flood using HEADERS frames results in unbounded memory growth [epel-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9514 [HIGH] CVE-2019-9514 nodejs: HTTP/2: flood using HEADERS frames results in unbounded memory growth [epel-all]
CVE-2019-9514 nodejs: HTTP/2: flood using HEADERS frames results in unbounded memory growth [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mult
Bugzilla
CVE-2019-9514 nodejs: http/2: HTTP/2 flood using HEADERS frames results in unbounded memory growth [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9514 [HIGH] CVE-2019-9514 nodejs: http/2: HTTP/2 flood using HEADERS frames results in unbounded memory growth [fedora-all]
CVE-2019-9514 nodejs: http/2: HTTP/2 flood using HEADERS frames results in unbounded memory growth [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue a
Bugzilla
CVE-2019-9514 golang: HTTP/2: flood using HEADERS frames results in unbounded memory growth [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9514 [HIGH] CVE-2019-9514 golang: HTTP/2: flood using HEADERS frames results in unbounded memory growth [fedora-all]
CVE-2019-9514 golang: HTTP/2: flood using HEADERS frames results in unbounded memory growth [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects
Bugzilla
CVE-2019-9514 nodejs: http/2: HTTP/2 flood using HEADERS frames results in unbounded memory growth [epel-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9514 [HIGH] CVE-2019-9514 nodejs: http/2: HTTP/2 flood using HEADERS frames results in unbounded memory growth [epel-all]
CVE-2019-9514 nodejs: http/2: HTTP/2 flood using HEADERS frames results in unbounded memory growth [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affec
Bugzilla
CVE-2019-9514 golang: HTTP/2: flood using HEADERS frames results in unbounded memory growth [epel-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9514 [HIGH] CVE-2019-9514 golang: HTTP/2: flood using HEADERS frames results in unbounded memory growth [epel-all]
CVE-2019-9514 golang: HTTP/2: flood using HEADERS frames results in unbounded memory growth [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mult
Bugzilla
CVE-2019-9514 nginx: HTTP/2: flood using HEADERS frames results in unbounded memory growth [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9514 [HIGH] CVE-2019-9514 nginx: HTTP/2: flood using HEADERS frames results in unbounded memory growth [fedora-all]
CVE-2019-9514 nginx: HTTP/2: flood using HEADERS frames results in unbounded memory growth [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects m
Bugzilla
CVE-2019-9514 nodejs: HTTP/2: flood using HEADERS frames results in unbounded memory growth [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9514 [HIGH] CVE-2019-9514 nodejs: HTTP/2: flood using HEADERS frames results in unbounded memory growth [fedora-all]
CVE-2019-9514 nodejs: HTTP/2: flood using HEADERS frames results in unbounded memory growth [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects
Bugzilla
CVE-2019-9514 nginx: HTTP/2: flood using HEADERS frames results in unbounded memory growth [epel-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9514 [HIGH] CVE-2019-9514 nginx: HTTP/2: flood using HEADERS frames results in unbounded memory growth [epel-all]
CVE-2019-9514 nginx: HTTP/2: flood using HEADERS frames results in unbounded memory growth [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multi
Bugzilla
CVE-2019-9514 HTTP/2: flood using HEADERS frames results in unbounded memory growth
bugzilla·2019-08-01·CVSS 7.5
CVE-2019-9514 [HIGH] CVE-2019-9514 HTTP/2: flood using HEADERS frames results in unbounded memory growth
CVE-2019-9514 HTTP/2: flood using HEADERS frames results in unbounded memory growth
HTTP/2 flood using HEADERS frames with invalid HTTP headers and queuing of response RST_STREAM frames that results in unbounded memory growth.
Discussion:
Acknowledgments:
Name: the Envoy security team
---
https://istio.io/blog/2019/announcing-1.2.4/
---
Golang issue:
https://github.com/golang/go/issues/33606
---
Created nginx tracking bugs for this issue:
Affects: epel-all [bug 1742310]
Affects: fedora-all [bug 1742308]
---
NodeJS upstream commit related to this CVE:
https://github.com/nodejs/node/commit/477461a51f
https://github.com/nodejs/node/commit/05dada46ee
---
Created kubernetes tracking bugs for this issue:
Affects: fedora-all [bug 1745595]
---
All golang upstream patches:
net/h
Tenable
Multiple Denial of Service (DoS) Vulnerabilities in HTTP/2 Disclosed (CVE-2019-9511, CVE-2019-9518)
blogs_tenable·2019-08-14·CVSS 7.5
[HIGH] Multiple Denial of Service (DoS) Vulnerabilities in HTTP/2 Disclosed (CVE-2019-9511, CVE-2019-9518)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Microsoft Patch Tuesday — Aug. 2019: Vulnerability disclosures and Snort coverage
blogs_talos·2019-08-13·CVSS 9.1
[CRITICAL] Microsoft Patch Tuesday — Aug. 2019: Vulnerability disclosures and Snort coverage
Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 97 vulnerabilities, 31 of which are rated “critical," 65 that are considered "important" and one "moderate."
This month’s security update covers security issues in a variety of Microsoft services and software, including certain graphics components, Outlook and the Chakra Scripting Engine. For more on our coverage of these bugs, check out our Snort advisories here, covering all of the new rules we have for this release.
### Critical vulnerabilities Microsoft disclosed 31 critical vulnerabilities this month, three of which we will highlight below.
CVE-2019-1181 and CVE-2019-1182 are both remote code execution vulnerabilities in Remote De
Talos
Microsoft Patch Tuesday — Aug. 2019: Vulnerability disclosures and Snort coverage
blogs_talos·2019-08-13·CVSS 9.8
[CRITICAL] Microsoft Patch Tuesday — Aug. 2019: Vulnerability disclosures and Snort coverage
## Microsoft Patch Tuesday — Aug. 2019: Vulnerability disclosures and Snort coverage
Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 97 vulnerabilities, 31 of which are rated “critical," 65 that are considered "important" and one "moderate."
This month’s security update covers security issues in a variety of Microsoft services and software, including certain graphics components, Outlook and the Chakra Scripting Engine. For more on our coverage of these bugs, check out our Snort advisories here , covering all of the new rules we have for this release.
## Critical vulnerabilities Microsoft disclosed 31 critical vulnerabilities this month, three of which we will highlight below.
CVE-2
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.htmlhttp://seclists.org/fulldisclosure/2019/Aug/16http://www.openwall.com/lists/oss-security/2019/08/20/1http://www.openwall.com/lists/oss-security/2023/10/18/8https://access.redhat.com/errata/RHSA-2019:2594https://access.redhat.com/errata/RHSA-2019:2661https://access.redhat.com/errata/RHSA-2019:2682https://access.redhat.com/errata/RHSA-2019:2690https://access.redhat.com/errata/RHSA-2019:2726https://access.redhat.com/errata/RHSA-2019:2766https://access.redhat.com/errata/RHSA-2019:2769https://access.redhat.com/errata/RHSA-2019:2796https://access.redhat.com/errata/RHSA-2019:2861https://access.redhat.com/errata/RHSA-2019:2925https://access.redhat.com/errata/RHSA-2019:2939https://access.redhat.com/errata/RHSA-2019:2955https://access.redhat.com/errata/RHSA-2019:2966https://access.redhat.com/errata/RHSA-2019:3131https://access.redhat.com/errata/RHSA-2019:3245https://access.redhat.com/errata/RHSA-2019:3265https://access.redhat.com/errata/RHSA-2019:3892https://access.redhat.com/errata/RHSA-2019:3906https://access.redhat.com/errata/RHSA-2019:4018https://access.redhat.com/errata/RHSA-2019:4019https://access.redhat.com/errata/RHSA-2019:4020https://access.redhat.com/errata/RHSA-2019:4021https://access.redhat.com/errata/RHSA-2019:4040https://access.redhat.com/errata/RHSA-2019:4041https://access.redhat.com/errata/RHSA-2019:4042https://access.redhat.com/errata/RHSA-2019:4045https://access.redhat.com/errata/RHSA-2019:4269https://access.redhat.com/errata/RHSA-2019:4273https://access.redhat.com/errata/RHSA-2019:4352https://access.redhat.com/errata/RHSA-2020:0406https://access.redhat.com/errata/RHSA-2020:0727https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdhttps://kb.cert.org/vuls/id/605641/https://kc.mcafee.com/corporate/index?page=content&id=SB10296https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3Ehttps://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3Ehttps://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/12/msg00011.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/https://seclists.org/bugtraq/2019/Aug/24https://seclists.org/bugtraq/2019/Aug/31https://seclists.org/bugtraq/2019/Aug/43https://seclists.org/bugtraq/2019/Sep/18https://security.netapp.com/advisory/ntap-20190823-0001/https://security.netapp.com/advisory/ntap-20190823-0004/https://security.netapp.com/advisory/ntap-20190823-0005/https://support.f5.com/csp/article/K01988340https://support.f5.com/csp/article/K01988340?utm_source=f5support&%3Butm_medium=RSShttps://usn.ubuntu.com/4308-1/https://www.debian.org/security/2019/dsa-4503https://www.debian.org/security/2019/dsa-4508https://www.debian.org/security/2019/dsa-4520https://www.debian.org/security/2020/dsa-4669https://www.synology.com/security/advisory/Synology_SA_19_33http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.htmlhttp://seclists.org/fulldisclosure/2019/Aug/16http://www.openwall.com/lists/oss-security/2019/08/20/1http://www.openwall.com/lists/oss-security/2023/10/18/8https://access.redhat.com/errata/RHSA-2019:2594https://access.redhat.com/errata/RHSA-2019:2661https://access.redhat.com/errata/RHSA-2019:2682https://access.redhat.com/errata/RHSA-2019:2690https://access.redhat.com/errata/RHSA-2019:2726https://access.redhat.com/errata/RHSA-2019:2766https://access.redhat.com/errata/RHSA-2019:2769https://access.redhat.com/errata/RHSA-2019:2796https://access.redhat.com/errata/RHSA-2019:2861https://access.redhat.com/errata/RHSA-2019:2925https://access.redhat.com/errata/RHSA-2019:2939https://access.redhat.com/errata/RHSA-2019:2955https://access.redhat.com/errata/RHSA-2019:2966https://access.redhat.com/errata/RHSA-2019:3131https://access.redhat.com/errata/RHSA-2019:3245https://access.redhat.com/errata/RHSA-2019:3265https://access.redhat.com/errata/RHSA-2019:3892https://access.redhat.com/errata/RHSA-2019:3906https://access.redhat.com/errata/RHSA-2019:4018https://access.redhat.com/errata/RHSA-2019:4019https://access.redhat.com/errata/RHSA-2019:4020https://access.redhat.com/errata/RHSA-2019:4021https://access.redhat.com/errata/RHSA-2019:4040
+ 34 more references
2019-08-13
Published