CVE-2019-9516
published 2019-08-13CVE-2019-9516: Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length…
PriorityP346medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
56.26%
99.0th percentile
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
Affected
40 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | traffic_server | 6.0.0 – 6.2.3 | — |
| apache | traffic_server | 7.0.0 – 7.1.6 | — |
| apache | traffic_server | 8.0.0 – 8.0.3 | — |
| apple | swiftnio | 1.0.0 – 1.4.0 | — |
| apple | swiftnio_http_2 | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | nginx | < nginx 1.14.2-3 (bookworm) | nginx 1.14.2-3 (bookworm) |
| f5 | nginx | >= 0 < 1.14.2-3 | 1.14.2-3 |
| f5 | nginx | >= 0 < 1.14.2-3 | 1.14.2-3 |
| f5 | nginx | >= 0 < 1.14.2-3 | 1.14.2-3 |
| f5 | nginx | >= 0 < 1.14.2-3 | 1.14.2-3 |
| f5 | nginx | 1.17.0 – 1.17.2 | — |
| f5 | nginx | >= 1.9.5 < 1.16.1 | 1.16.1 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| mcafee | web_gateway | >= 7.7.2.0 < 7.7.2.24 | 7.7.2.24 |
| mcafee | web_gateway | >= 7.8.2.0 < 7.8.2.13 | 7.8.2.13 |
| mcafee | web_gateway | >= 8.1.0 < 8.2.0 | 8.2.0 |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP/2 streams containing headers with 0-length header name and 0-length header value, optionally Huffman encoded, sent repeatedly to exhaust server memory ↗
- →Monitor for unbounded memory growth on HTTP/2 servers correlating with sustained inbound connections; resource exhaustion is the primary observable impact ↗
- ·Disabling HTTP/2 support in nginx mitigates the vulnerability; Red Hat documents a sed-based procedure to strip 'http2' from nginx.conf as an interim workaround ↗
- ·nodejs package has no available mitigation and must await upstream fixes; the nodejs RPM in OpenShift Container Platform 3.9 and 3.10 is not affected as it does not contain the vulnerable code ↗
- ·SwiftNIO HTTP/2 1.5.0 addresses the issue via improved buffer size management; deployments should upgrade to this version or later ↗
- ·nginx (Debian) is fixed in version 1.14.2-3 across bookworm, bullseye, forky, sid, and trixie ↗
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.06.8MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:C
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_msrc6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
nginx vulnerabilities
vendor_ubuntu·2019-08-15
CVE-2019-9511 nginx vulnerabilities
Title: nginx vulnerabilities
Summary: nginx could be made to crash if it received specially crafted network
traffic.
Jonathan Looney discovered that nginx incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to consume
resources, leading to a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
HTTP/2: 0-length headers lead to denial of service
vendor_redhat·2019-08-13·CVSS 6.5
CVE-2019-9516 [MEDIUM] CWE-400 HTTP/2: 0-length headers lead to denial of service
HTTP/2: 0-length headers lead to denial of service
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially leading to a denial of service. The highest threat from
Microsoft
Some HTTP/2 implementations are vulnerable to a header leak potentially leading to a denial of service
vendor_msrc·2019-08-13·CVSS 6.5
CVE-2019-9516 [MEDIUM] CWE-770 Some HTTP/2 implementations are vulnerable to a header leak potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to a header leak potentially leading to a denial of service
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
certcc: certcc
Customer Action Required: Yes
Remediatio
Apple
CVE-2019-9516: SwiftNIO HTTP/2 1.5.0
vendor_apple·2019-08-13·CVSS 6.5
CVE-2019-9516 [MEDIUM] CVE-2019-9516: SwiftNIO HTTP/2 1.5.0
Apple Security Update: About the security content of SwiftNIO HTTP/2 1.5.0
Product: SwiftNIO HTTP/2
Version: 1.5.0
CVE: CVE-2019-9516
Component: SwiftNIO HTTP/2
Impact: A HTTP/2 server may consume unbounded amounts of memory when receiving certain traffic patterns and eventually suffer resource exhaustion
Description: This issue was addressed with improved buffer size management.
Debian
CVE-2019-9516: nginx - Some HTTP/2 implementations are vulnerable to a header leak, potentially leading...
vendor_debian·2019·CVSS 6.5
CVE-2019-9516 [MEDIUM] CVE-2019-9516: nginx - Some HTTP/2 implementations are vulnerable to a header leak, potentially leading...
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
Scope: local
bookworm: resolved (fixed in 1.14.2-3)
bullseye: resolved (fixed in 1.14.2-3)
forky: resolved (fixed in 1.14.2-3)
sid: resolved (fixed in 1.14.2-3)
trixie: resolved (fixed in 1.14.2-3)
GHSA
GHSA-6gw7-c226-vg73: Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service
ghsa_unreviewed·2022-05-24
CVE-2019-9516 [MEDIUM] CWE-400 GHSA-6gw7-c226-vg73: Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
OSV
CVE-2019-9516: Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service
osv·2019-08-13·CVSS 6.5
CVE-2019-9516 [MEDIUM] CVE-2019-9516: Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
No detection rules found.
No public exploits indexed.
HackerOne
Nginx version is disclosed in HTTP response
hackerone·2020-02-06·CVSS 7.5
[HIGH] Nginx version is disclosed in HTTP response
Nginx version is disclosed in HTTP response
## Summary:
I found a version disclosure (Nginx) in your web server's HTTP response.
***Extracted Version:*** 1.16.1
This information might help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Nginx.
## Steps To Reproduce:
***Checkout the URL:** https://localizestaging.com/
Checkout the header response:
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sun, 26 Jan 2020 21:37:55 GMT
Server: nginx/1.16.1
Vary: Accept-Encoding
X-DNS-Prefetch-Control: off
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: object-src 'none'; base-uri https://localizestaging.com; frame-ancestors https://loc
Bugzilla
EPEL7 nginx package contains multiple CVEs
bugzilla·2019-09-10·CVSS 7.5
CVE-2019-9511 [HIGH] EPEL7 nginx package contains multiple CVEs
EPEL7 nginx package contains multiple CVEs
EPEL7 currently includes nginx 1.12.2, which is vulnerable to multiple CVS including CVE-2019-9511, CVE-2019-9513, CVE-2019-9516 and which will not be patched upstream due to being EOL. Version 1.16.1 is packaged in current Fedora.
Version-Release number of selected component (if applicable):
nginx-1.12.2-3
How reproducible:
Always
Steps to Reproduce:
1. yum install nginx
Actual results:
nginx is version 1.12.2
Expected results:
nginx should be version 1.16.1
Discussion:
I haven't been involved here for many years but I noticed this ticket. As the old EPEL7 version is no longer patched upstream we may have no choice but to upgrade it to match Fedora. That is assuming nobody really has time to go through the effort of backporting the C
Bugzilla
CVE-2019-9516 undertow: HTTP/2: 0-length headers lead to denial of service [fedora-all]
bugzilla·2019-09-03·CVSS 6.5
CVE-2019-9516 [MEDIUM] CVE-2019-9516 undertow: HTTP/2: 0-length headers lead to denial of service [fedora-all]
CVE-2019-9516 undertow: HTTP/2: 0-length headers lead to denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supporte
Bugzilla
CVE-2019-9516 nginx: HTTP/2: 0-length headers lead to denial of service [epel-all]
bugzilla·2019-08-16·CVSS 6.5
CVE-2019-9516 [MEDIUM] CVE-2019-9516 nginx: HTTP/2: 0-length headers lead to denial of service [epel-all]
CVE-2019-9516 nginx: HTTP/2: 0-length headers lead to denial of service [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versi
Bugzilla
CVE-2019-9516 nodejs: HTTP/2: 0-length headers lead to denial of service [epel-all]
bugzilla·2019-08-16·CVSS 6.5
CVE-2019-9516 [MEDIUM] CVE-2019-9516 nodejs: HTTP/2: 0-length headers lead to denial of service [epel-all]
CVE-2019-9516 nodejs: HTTP/2: 0-length headers lead to denial of service [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported vers
Bugzilla
CVE-2019-9511 CVE-2019-9516 CVE-2019-9517 mod_http2: various flaws [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9511 [HIGH] CVE-2019-9511 CVE-2019-9516 CVE-2019-9517 mod_http2: various flaws [fedora-all]
CVE-2019-9511 CVE-2019-9516 CVE-2019-9517 mod_http2: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versio
Bugzilla
CVE-2019-9516 httpd: HTTP/2: 0-length headers leads to denial of service [fedora-all]
bugzilla·2019-08-16·CVSS 6.5
CVE-2019-9516 [MEDIUM] CVE-2019-9516 httpd: HTTP/2: 0-length headers leads to denial of service [fedora-all]
CVE-2019-9516 httpd: HTTP/2: 0-length headers leads to denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2019-9516 HTTP/2: 0-length headers lead to denial of service
bugzilla·2019-08-16·CVSS 6.5
CVE-2019-9516 [MEDIUM] CVE-2019-9516 HTTP/2: 0-length headers lead to denial of service
CVE-2019-9516 HTTP/2: 0-length headers lead to denial of service
A vulnerability was found in http/2 where an attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory, potentially leading to a denial of service.
Discussion:
Created httpd tracking bugs for this issue:
Affects: fedora-all [bug 1741866]
---
Created mod_http2 tracking bugs for this issue:
Affects: fedora-all [bug 1741948]
Created nghttp2 tracking bugs for this issue:
Affects: fedora-all [bug 1741947]
---
Created nghttp2 tracking bugs for this issue:
Affects: epel-all [bug 1741950]
---
Bugzilla
CVE-2019-9516 nginx: HTTP/2: 0-length headers leads to denial of service [fedora-all]
bugzilla·2019-08-16·CVSS 6.5
CVE-2019-9516 [MEDIUM] CVE-2019-9516 nginx: HTTP/2: 0-length headers leads to denial of service [fedora-all]
CVE-2019-9516 nginx: HTTP/2: 0-length headers leads to denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2019-9516 nodejs: HTTP/2: 0-length headers leads to denial of service [fedora-all]
bugzilla·2019-08-16·CVSS 6.5
CVE-2019-9516 [MEDIUM] CVE-2019-9516 nodejs: HTTP/2: 0-length headers leads to denial of service [fedora-all]
CVE-2019-9516 nodejs: HTTP/2: 0-length headers leads to denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2018-9516 kernel: HID: debug: Buffer overflow in hid_debug_events_read() in drivers/hid/hid-debug.c
bugzilla·2018-09-19·CVSS 7.8
CVE-2018-9516 [HIGH] CVE-2018-9516 kernel: HID: debug: Buffer overflow in hid_debug_events_read() in drivers/hid/hid-debug.c
CVE-2018-9516 kernel: HID: debug: Buffer overflow in hid_debug_events_read() in drivers/hid/hid-debug.c
A flaw was found in the Linux kernel in the hid_debug_events_read() function in the drivers/hid/hid-debug.c file. A lack of the certain checks may allow a privileged user ("root") to achieve an out-of-bounds write and thus receiving userspace buffer corruption.
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=717adfdaf14704fd3ec7fa2c04520c0723247eac
Note: this fix introduces another vulnerability CVE-2019-3819/bz1669187 and these both should be fixed.
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1631037]
---
This was fixed for Fedora with 4.17.6 stable updates
---
This issue has been addressed
Tenable
Multiple Denial of Service (DoS) Vulnerabilities in HTTP/2 Disclosed (CVE-2019-9511, CVE-2019-9518)
blogs_tenable·2019-08-14·CVSS 7.5
[HIGH] Multiple Denial of Service (DoS) Vulnerabilities in HTTP/2 Disclosed (CVE-2019-9511, CVE-2019-9518)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.htmlhttp://seclists.org/fulldisclosure/2019/Aug/16https://access.redhat.com/errata/RHSA-2019:2745https://access.redhat.com/errata/RHSA-2019:2746https://access.redhat.com/errata/RHSA-2019:2775https://access.redhat.com/errata/RHSA-2019:2799https://access.redhat.com/errata/RHSA-2019:2925https://access.redhat.com/errata/RHSA-2019:2939https://access.redhat.com/errata/RHSA-2019:2946https://access.redhat.com/errata/RHSA-2019:2950https://access.redhat.com/errata/RHSA-2019:2955https://access.redhat.com/errata/RHSA-2019:2966https://access.redhat.com/errata/RHSA-2019:3932https://access.redhat.com/errata/RHSA-2019:3933https://access.redhat.com/errata/RHSA-2019:3935https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdhttps://kb.cert.org/vuls/id/605641/https://kc.mcafee.com/corporate/index?page=content&id=SB10296https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/https://seclists.org/bugtraq/2019/Aug/24https://seclists.org/bugtraq/2019/Aug/40https://security.netapp.com/advisory/ntap-20190823-0002/https://security.netapp.com/advisory/ntap-20190823-0005/https://support.f5.com/csp/article/K02591030https://support.f5.com/csp/article/K02591030?utm_source=f5support&%3Butm_medium=RSShttps://usn.ubuntu.com/4099-1/https://www.debian.org/security/2019/dsa-4505https://www.synology.com/security/advisory/Synology_SA_19_33http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.htmlhttp://seclists.org/fulldisclosure/2019/Aug/16https://access.redhat.com/errata/RHSA-2019:2745https://access.redhat.com/errata/RHSA-2019:2746https://access.redhat.com/errata/RHSA-2019:2775https://access.redhat.com/errata/RHSA-2019:2799https://access.redhat.com/errata/RHSA-2019:2925https://access.redhat.com/errata/RHSA-2019:2939https://access.redhat.com/errata/RHSA-2019:2946https://access.redhat.com/errata/RHSA-2019:2950https://access.redhat.com/errata/RHSA-2019:2955https://access.redhat.com/errata/RHSA-2019:2966https://access.redhat.com/errata/RHSA-2019:3932https://access.redhat.com/errata/RHSA-2019:3933https://access.redhat.com/errata/RHSA-2019:3935https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdhttps://kb.cert.org/vuls/id/605641/https://kc.mcafee.com/corporate/index?page=content&id=SB10296https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/https://seclists.org/bugtraq/2019/Aug/24https://seclists.org/bugtraq/2019/Aug/40https://security.netapp.com/advisory/ntap-20190823-0002/https://security.netapp.com/advisory/ntap-20190823-0005/https://support.f5.com/csp/article/K02591030https://support.f5.com/csp/article/K02591030?utm_source=f5support&%3Butm_medium=RSShttps://usn.ubuntu.com/4099-1/https://www.debian.org/security/2019/dsa-4505https://www.synology.com/security/advisory/Synology_SA_19_33
2019-08-13
Published