CVE-2019-9515
published 2019-08-13CVE-2019-9515: Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to…
PriorityP359high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
87.81%
99.7th percentile
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Affected
48 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | traffic_server | 6.0.0 – 6.2.3 | — |
| apache | traffic_server | 7.0.0 – 7.1.6 | — |
| apache | traffic_server | 8.0.0 – 8.0.3 | — |
| apple | swiftnio | 1.0.0 – 1.4.0 | — |
| apple | swiftnio_http_2 | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | h2o | < h2o 2.2.5+dfsg2-3 (bookworm) | h2o 2.2.5+dfsg2-3 (bookworm) |
| debian | trafficserver | < h2o 2.2.5+dfsg2-3 (bookworm) | h2o 2.2.5+dfsg2-3 (bookworm) |
| f5 | big-ip_local_traffic_manager | >= 11.6.1 < 11.6.5.1 | 11.6.5.1 |
| f5 | big-ip_local_traffic_manager | >= 12.1.0 < 12.1.5.1 | 12.1.5.1 |
| f5 | big-ip_local_traffic_manager | >= 13.1.0 < 13.1.3.2 | 13.1.3.2 |
| f5 | big-ip_local_traffic_manager | >= 14.0.0 < 14.0.1.1 | 14.0.1.1 |
| f5 | big-ip_local_traffic_manager | >= 14.1.0 < 14.1.2.1 | 14.1.2.1 |
| f5 | big-ip_local_traffic_manager | >= 15.0.0 < 15.0.1.1 | 15.0.1.1 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| h2o | h2o | >= 0 < 2.2.5+dfsg2-3 | 2.2.5+dfsg2-3 |
| h2o | h2o | >= 0 < 2.2.5+dfsg2-3 | 2.2.5+dfsg2-3 |
| mcafee | web_gateway | >= 7.7.2.0 < 7.7.2.24 | 7.7.2.24 |
| mcafee | web_gateway | >= 7.8.2.0 < 7.8.2.13 | 7.8.2.13 |
| mcafee | web_gateway | >= 8.1.0 < 8.2.0 | 8.2.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect a flood of HTTP/2 SETTINGS frames sent by a client to a server — each empty SETTINGS frame forces one ACK, causing unbounded memory/CPU growth ↗
- →Monitor for rapid, continuous growth in queued SETTINGS ACK frames on HTTP/2 connections, which is the direct mechanism of unbounded memory growth ↗
- ·nodejs shipped in OpenShift Container Platform 3.9 and 3.10 is NOT affected as it does not contain the vulnerable code ↗
- ·SwiftNIO HTTP/2 is fixed in version 1.5.0 via improved buffer size management; systems running earlier versions remain vulnerable ↗
- ·grafana (embedding gRPC) as shipped with Red Hat Ceph Storage 3 is affected due to HTTP/2 support but marked 'Will not fix' ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Netty vulnerabilities
vendor_ubuntu·2021-06-29·CVSS 7.5
CVE-2019-9514 [HIGH] Netty vulnerabilities
Title: Netty vulnerabilities
Summary: Several security issues were fixed in Netty.
It was discovered that Netty incorrectly implements HTTP/2. An attacker
could possibly use this issue to cause a denial of service. (CVE-2019-9512,
CVE-2019-9514, CVE-2019-9515, CVE-2019-9518)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Twisted vulnerabilities
vendor_ubuntu·2020-03-19·CVSS 6.1
CVE-2019-12387 [MEDIUM] Twisted vulnerabilities
Title: Twisted vulnerabilities
Summary: Several security issues were fixed in Twisted.
it was discovered that Twisted incorrectly validated or sanitized certain
URIs or HTTP methods. A remote attacker could use this issue to inject
invalid characters and possibly perform header injection attacks.
(CVE-2019-12387)
It was discovered that Twisted incorrectly verified XMPP TLS certificates.
A remote attacker could possibly use this issue to perform a
machine-in-the-middle attack and obtain sensitive information. (CVE-2019-12855)
It was discovered that Twisted incorrectly handled HTTP/2 connections. A
remote attacker could possibly use this issue to cause Twisted to hang or
consume resources, leading to a denial of service. This issue only affected
Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-20
Red Hat
HTTP/2: flood using SETTINGS frames results in unbounded memory growth
vendor_redhat·2019-08-13·CVSS 7.5
CVE-2019-9515 [HIGH] CWE-400 HTTP/2: flood using SETTINGS frames results in unbounded memory growth
HTTP/2: flood using SETTINGS frames results in unbounded memory growth
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
A flaw was found in HTTP/2. Using SETTINGS frames and queuing of SETTINGS ACK frames, a flood could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability.
Statement: This issue affects the version of grafana(embeds gRPC) as shipped with Red Hat Ce
Apple
CVE-2019-9515: SwiftNIO HTTP/2 1.5.0
vendor_apple·2019-08-13·CVSS 7.5
CVE-2019-9515 [HIGH] CVE-2019-9515: SwiftNIO HTTP/2 1.5.0
Apple Security Update: About the security content of SwiftNIO HTTP/2 1.5.0
Product: SwiftNIO HTTP/2
Version: 1.5.0
CVE: CVE-2019-9515
Component: SwiftNIO HTTP/2
Impact: A HTTP/2 server may consume unbounded amounts of memory when receiving certain traffic patterns and eventually suffer resource exhaustion
Description: This issue was addressed with improved buffer size management.
Debian
CVE-2019-9515: h2o - Some HTTP/2 implementations are vulnerable to a settings flood, potentially lead...
vendor_debian·2019·CVSS 7.5
CVE-2019-9515 [HIGH] CVE-2019-9515: h2o - Some HTTP/2 implementations are vulnerable to a settings flood, potentially lead...
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Scope: local
bookworm: resolved (fixed in 2.2.5+dfsg2-3)
bullseye: resolved (fixed in 2.2.5+dfsg2-3)
GHSA
GHSA-9259-5376-vjcj: Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service
ghsa_unreviewed·2022-05-24
CVE-2019-9515 [HIGH] CWE-400 GHSA-9259-5376-vjcj: Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
OSV
HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
osv·2022-03-14·CVSS 7.5
CVE-2019-9512 [HIGH] HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
### Impact
Twisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities:
Ping flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512
Reset flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514
Settings flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9515
A Twisted web server supports HTTP/2 requests if you've installed the [`http2` optional dependency set](https://twistedmatrix.com/documents/19.2.0/installation/howto/optional.html).
### Workarounds
There are no workarounds.
### References
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
### For more information
If you have any question
GHSA
HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
ghsa·2022-03-14·CVSS 7.5
CVE-2019-9512 [HIGH] HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
### Impact
Twisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities:
Ping flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512
Reset flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514
Settings flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9515
A Twisted web server supports HTTP/2 requests if you've installed the [`http2` optional dependency set](https://twistedmatrix.com/documents/19.2.0/installation/howto/optional.html).
### Workarounds
There are no workarounds.
### References
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
### For more information
If you have any question
OSV
netty vulnerabilities
osv·2021-06-29·CVSS 7.5
CVE-2019-9512 [HIGH] netty vulnerabilities
netty vulnerabilities
It was discovered that Netty incorrectly implements HTTP/2. An attacker
could possibly use this issue to cause a denial of service. (CVE-2019-9512,
CVE-2019-9514, CVE-2019-9515, CVE-2019-9518)
OSV
twisted vulnerabilities
osv·2020-03-19·CVSS 6.1
CVE-2019-12387 [MEDIUM] twisted vulnerabilities
twisted vulnerabilities
it was discovered that Twisted incorrectly validated or sanitized certain
URIs or HTTP methods. A remote attacker could use this issue to inject
invalid characters and possibly perform header injection attacks.
(CVE-2019-12387)
It was discovered that Twisted incorrectly verified XMPP TLS certificates.
A remote attacker could possibly use this issue to perform a
machine-in-the-middle attack and obtain sensitive information. (CVE-2019-12855)
It was discovered that Twisted incorrectly handled HTTP/2 connections. A
remote attacker could possibly use this issue to cause Twisted to hang or
consume resources, leading to a denial of service. This issue only affected
Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-9512, CVE-2019-9514,
CVE-2019-9515)
Jake Miller and ZeddYu L
OSV
CVE-2019-9515: Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service
osv·2019-08-13·CVSS 7.5
CVE-2019-9515 [HIGH] CVE-2019-9515: Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-9515 undertow: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [fedora-all]
bugzilla·2019-09-03·CVSS 7.5
CVE-2019-9515 [HIGH] CVE-2019-9515 undertow: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [fedora-all]
CVE-2019-9515 undertow: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affec
Bugzilla
CVE-2019-9515 nodejs: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [epel-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9515 [HIGH] CVE-2019-9515 nodejs: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [epel-all]
CVE-2019-9515 nodejs: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mul
Bugzilla
CVE-2019-9515 nodejs: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9515 [HIGH] CVE-2019-9515 nodejs: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [fedora-all]
CVE-2019-9515 nodejs: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects
Bugzilla
CVE-2019-9515 nginx: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [epel-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9515 [HIGH] CVE-2019-9515 nginx: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [epel-all]
CVE-2019-9515 nginx: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mult
Bugzilla
CVE-2019-9515 nodejs: http/2: HTTP/2 flood using SETTINGS frames results in unbounded memory growth [epel-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9515 [HIGH] CVE-2019-9515 nodejs: http/2: HTTP/2 flood using SETTINGS frames results in unbounded memory growth [epel-all]
CVE-2019-9515 nodejs: http/2: HTTP/2 flood using SETTINGS frames results in unbounded memory growth [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affe
Bugzilla
CVE-2019-9515 nodejs: http/2: HTTP/2 flood using SETTINGS frames results in unbounded memory growth [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9515 [HIGH] CVE-2019-9515 nodejs: http/2: HTTP/2 flood using SETTINGS frames results in unbounded memory growth [fedora-all]
CVE-2019-9515 nodejs: http/2: HTTP/2 flood using SETTINGS frames results in unbounded memory growth [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue
Bugzilla
CVE-2019-9515 nginx: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9515 [HIGH] CVE-2019-9515 nginx: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [fedora-all]
CVE-2019-9515 nginx: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects
Bugzilla
CVE-2019-9515 HTTP/2: flood using SETTINGS frames results in unbounded memory growth
bugzilla·2019-08-01·CVSS 7.5
CVE-2019-9515 [HIGH] CVE-2019-9515 HTTP/2: flood using SETTINGS frames results in unbounded memory growth
CVE-2019-9515 HTTP/2: flood using SETTINGS frames results in unbounded memory growth
HTTP/2 flood using SETTINGS frames and queueing of SETTINGS ACK frames that results in unbounded memory growth.
Discussion:
Acknowledgments:
Name: the Envoy security team
---
https://istio.io/blog/2019/announcing-1.2.4/
---
Created nginx tracking bugs for this issue:
Affects: epel-all [bug 1742333]
Affects: fedora-all [bug 1742332]
---
NodeJS upstream commits:
https://github.com/nodejs/node/commit/74507fae34
https://github.com/nodejs/node/commit/0acbe05ee2
---
External References:
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
https://www.mail-archive.com/[email protected]
Tenable
Multiple Denial of Service (DoS) Vulnerabilities in HTTP/2 Disclosed (CVE-2019-9511, CVE-2019-9518)
blogs_tenable·2019-08-14·CVSS 7.5
[HIGH] Multiple Denial of Service (DoS) Vulnerabilities in HTTP/2 Disclosed (CVE-2019-9511, CVE-2019-9518)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlhttp://seclists.org/fulldisclosure/2019/Aug/16https://access.redhat.com/errata/RHSA-2019:2766https://access.redhat.com/errata/RHSA-2019:2796https://access.redhat.com/errata/RHSA-2019:2861https://access.redhat.com/errata/RHSA-2019:2925https://access.redhat.com/errata/RHSA-2019:2939https://access.redhat.com/errata/RHSA-2019:2955https://access.redhat.com/errata/RHSA-2019:3892https://access.redhat.com/errata/RHSA-2019:4018https://access.redhat.com/errata/RHSA-2019:4019https://access.redhat.com/errata/RHSA-2019:4020https://access.redhat.com/errata/RHSA-2019:4021https://access.redhat.com/errata/RHSA-2019:4040https://access.redhat.com/errata/RHSA-2019:4041https://access.redhat.com/errata/RHSA-2019:4042https://access.redhat.com/errata/RHSA-2019:4045https://access.redhat.com/errata/RHSA-2019:4352https://access.redhat.com/errata/RHSA-2020:0727https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdhttps://kb.cert.org/vuls/id/605641/https://kc.mcafee.com/corporate/index?page=content&id=SB10296https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3Ehttps://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3Ehttps://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/https://seclists.org/bugtraq/2019/Aug/24https://seclists.org/bugtraq/2019/Aug/43https://seclists.org/bugtraq/2019/Sep/18https://security.netapp.com/advisory/ntap-20190823-0005/https://support.f5.com/csp/article/K50233772https://support.f5.com/csp/article/K50233772?utm_source=f5support&%3Butm_medium=RSShttps://usn.ubuntu.com/4308-1/https://www.debian.org/security/2019/dsa-4508https://www.debian.org/security/2019/dsa-4520https://www.synology.com/security/advisory/Synology_SA_19_33http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlhttp://seclists.org/fulldisclosure/2019/Aug/16https://access.redhat.com/errata/RHSA-2019:2766https://access.redhat.com/errata/RHSA-2019:2796https://access.redhat.com/errata/RHSA-2019:2861https://access.redhat.com/errata/RHSA-2019:2925https://access.redhat.com/errata/RHSA-2019:2939https://access.redhat.com/errata/RHSA-2019:2955https://access.redhat.com/errata/RHSA-2019:3892https://access.redhat.com/errata/RHSA-2019:4018https://access.redhat.com/errata/RHSA-2019:4019https://access.redhat.com/errata/RHSA-2019:4020https://access.redhat.com/errata/RHSA-2019:4021https://access.redhat.com/errata/RHSA-2019:4040https://access.redhat.com/errata/RHSA-2019:4041https://access.redhat.com/errata/RHSA-2019:4042https://access.redhat.com/errata/RHSA-2019:4045https://access.redhat.com/errata/RHSA-2019:4352https://access.redhat.com/errata/RHSA-2020:0727https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdhttps://kb.cert.org/vuls/id/605641/https://kc.mcafee.com/corporate/index?page=content&id=SB10296https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3Ehttps://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3Ehttps://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/https://seclists.org/bugtraq/2019/Aug/24https://seclists.org/bugtraq/2019/Aug/43https://seclists.org/bugtraq/2019/Sep/18https://security.netapp.com/advisory/ntap-20190823-0005/https://support.f5.com/csp/article/K50233772https://support.f5.com/csp/article/K50233772?utm_source=f5support&%3Butm_medium=RSShttps://usn.ubuntu.com/4308-1/https://www.debian.org/security/2019/dsa-4508https://www.debian.org/security/2019/dsa-4520https://www.synology.com/security/advisory/Synology_SA_19_33
2019-08-13
Published