CVE-2019-9512
High
Description
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
SeverityHigh
CVSS7.5
Exploit probability100. percentile83.4%
Product
Apple Swiftnio
PublishedAug 13, 2019
First seenAug 13, 2019
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- nodejs node.js8.16.1, 10.16.3, 12.8.1 or later
- golang.org/x/net0.0.0-20190813141303-74dc4d7220e7 or later
- stdlib1.11.13, 1.12.8 or later
Vendor advisories
- debian.org/security/2019/dsa-4503
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- debian.org/security/2019/dsa-4508
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/
- access.redhat.com/errata/RHSA-2019:2682
- debian.org/security/2019/dsa-4520
- access.redhat.com/errata/RHSA-2019:2726
- access.redhat.com/errata/RHSA-2019:2594
- access.redhat.com/errata/RHSA-2019:2661
- access.redhat.com/errata/RHSA-2019:2690
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple swiftnio | 1.0.0 ≤ v ≤ 1.4.0 | — |
| apache traffic_server | 6.0.0 ≤ v ≤ 6.2.3, 7.0.0 ≤ v ≤ 7.1.6, 8.0.0 ≤ v ≤ 8.0.3 | — |
| debian debian_linux | 10.0 | — |
| nodejs node.js | 8.0.0 ≤ v ≤ 8.8.1, 8.9.0 ≤ v < 8.16.1, 10.0.0 ≤ v ≤ 10.12.0, 10.13.0 ≤ v < 10.16.3, 12.0.0 ≤ v < 12.8.1 | 8.16.1, 10.16.3, 12.8.1 |
| golang.org/x/netGo | v < 0.0.0-20190813141303-74dc4d7220e7 | 0.0.0-20190813141303-74dc4d7220e7 |
| stdlibGo | v < 1.11.13, 1.12.0-0 ≤ v < 1.12.8 | 1.11.13, 1.12.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.