VulnerabilityModified

CVE-2019-9514

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.

HIGH 7.5EPSS 82.8%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 82.8%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 82.81% probability · 100th percentile
CISA KEV: Not listed
Weakness: CWE-400, CWE-770
Affected: apple/swiftnio · apache/traffic server · debian/debian linux · canonical/ubuntu linux · synology/skynas · synology/diskstation manager · synology/vs960hd firmware · fedoraproject/fedora · opensuse/leap · redhat/developer tools · redhat/jboss core services · redhat/jboss enterprise application platform · redhat/openshift container platform · redhat/openshift service mesh · redhat/openstack · redhat/quay · redhat/single sign-on · redhat/software collections · redhat/enterprise linux · redhat/enterprise linux eus · +8 more
Source: cret@cert.org

References

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.htmlMailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2019/Aug/16Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/08/20/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/18/8
https://access.redhat.com/errata/RHSA-2019:2594Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2661Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2682Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2690Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2726Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2766Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2769Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2796Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2861Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2925Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2939Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2955Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2966Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3131Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3245Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3265Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3892Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3906Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4018Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4019Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.