VulnerabilityModified

CVE-2019-9511

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service.

HIGH 7.5EPSS 59.5%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 59.5%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 59.55% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-400, CWE-770
Affected: apple/swiftnio · apache/traffic server · canonical/ubuntu linux · debian/debian linux · synology/skynas · synology/diskstation manager · synology/vs960hd firmware · fedoraproject/fedora · opensuse/leap · redhat/jboss core services · redhat/jboss enterprise application platform · redhat/openshift service mesh · redhat/quay · redhat/software collections · redhat/enterprise linux · oracle/graalvm · mcafee/web gateway · f5/nginx · oracle/enterprise communications broker · nodejs/node.js
Source: cret@cert.org

References

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.htmlMailing List, Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2692Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2745Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2746Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2775Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2799Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2925Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2939Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2949Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2955Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2966Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3041Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3932Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3933Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3935Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4018Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4019Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4020Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4021Third Party Advisory
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdThird Party Advisory
https://kb.cert.org/vuls/id/605641/Third Party Advisory, US Government Resource
https://kc.mcafee.com/corporate/index?page=content&id=SB10296Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.