CVE-2019-9513
High
Description
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
SeverityHigh
CVSS7.5
Exploit probability100. percentile81.6%
Product
Apple Swiftnio
PublishedAug 13, 2019
First seenAug 13, 2019
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- mcafee web_gateway7.7.2.24, 7.8.2.13, 8.2.0 or later
- f5 nginx1.16.1 or later
- nodejs node.js8.16.1, 10.16.3, 12.8.1 or later
Vendor advisories
- usn.ubuntu.com/4099-1/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/
- debian.org/security/2019/dsa-4505
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/
- debian.org/security/2019/dsa-4511
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/
- access.redhat.com/errata/RHSA-2019:2692
- access.redhat.com/errata/RHSA-2019:2745
- access.redhat.com/errata/RHSA-2019:2746
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple swiftnio | 1.0.0 ≤ v ≤ 1.4.0 | — |
| apache traffic_server | 6.0.0 ≤ v ≤ 6.2.3, 7.0.0 ≤ v ≤ 7.1.6, 8.0.0 ≤ v ≤ 8.0.3 | — |
| canonical ubuntu_linux | 16.04, 18.04, 19.04 | — |
| debian debian_linux | 9.0, 10.0 | — |
| fedoraproject fedora | 30, 29 | — |
| synology skynas | No range specified | — |
| synology diskstation_manager | 6.2 | — |
| synology vs960hd_firmware | No range specified | — |
| opensuse leap | 15.0, 15.1 | — |
| redhat jboss_core_services | 1.0 | — |
| redhat jboss_enterprise_application_platform | 7.2.0, 7.3.0 | — |
| redhat openshift_service_mesh | 1.0 | — |
| redhat quay | 3.0.0 | — |
| redhat software_collections | 1.0 | — |
| redhat enterprise_linux | 8.0 | — |
| oracle graalvm | 19.2.0 | — |
| mcafee web_gateway | 7.7.2.0 ≤ v < 7.7.2.24, 7.8.2.0 ≤ v < 7.8.2.13, 8.1.0 ≤ v < 8.2.0 | 7.7.2.24, 7.8.2.13, 8.2.0 |
| f5 nginx | 1.9.5 ≤ v < 1.16.1, 1.17.0 ≤ v ≤ 1.17.2 | 1.16.1 |
| oracle enterprise_communications_broker | 3.1.0, 3.2.0 | — |
| nodejs node.js | 8.0.0 ≤ v ≤ 8.8.1, 8.9.0 ≤ v < 8.16.1, 10.0.0 ≤ v ≤ 10.12.0, 10.13.0 ≤ v < 10.16.3, 12.0.0 ≤ v < 12.8.1 | 8.16.1, 10.16.3, 12.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.