CVE-2019-9514
High
Description
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
SeverityHigh
CVSS7.5
Exploit probability100. percentile82.8%
Product
Apple Swiftnio
PublishedAug 13, 2019
First seenAug 13, 2019
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- mcafee web_gateway7.7.2.24, 7.8.2.13, 8.2.0 or later
- f5 big-ip_local_traffic_manager11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1 or later
- nodejs node.js8.16.1, 10.16.3, 12.8.1 or later
Vendor advisories
- debian.org/security/2019/dsa-4503
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- debian.org/security/2019/dsa-4508
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/
- access.redhat.com/errata/RHSA-2019:2682
- debian.org/security/2019/dsa-4520
- access.redhat.com/errata/RHSA-2019:2726
- access.redhat.com/errata/RHSA-2019:2594
- access.redhat.com/errata/RHSA-2019:2661
- access.redhat.com/errata/RHSA-2019:2690
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple swiftnio | 1.0.0 ≤ v ≤ 1.4.0 | — |
| apache traffic_server | 6.0.0 ≤ v ≤ 6.2.3, 7.0.0 ≤ v ≤ 7.1.6, 8.0.0 ≤ v ≤ 8.0.3 | — |
| debian debian_linux | 10.0, 9.0 | — |
| canonical ubuntu_linux | 16.04, 18.04, 19.04 | — |
| synology skynas | No range specified | — |
| synology diskstation_manager | 6.2 | — |
| synology vs960hd_firmware | No range specified | — |
| fedoraproject fedora | 29, 30 | — |
| opensuse leap | 15.0, 15.1 | — |
| redhat developer_tools | 1.0 | — |
| redhat jboss_core_services | 1.0 | — |
| redhat jboss_enterprise_application_platform | 7.2.0, 7.3.0 | — |
| redhat openshift_container_platform | 3.9, 3.10, 3.11, 4.1, 4.2 | — |
| redhat openshift_service_mesh | 1.0 | — |
| redhat openstack | 14 | — |
| redhat quay | 3.0.0 | — |
| redhat single_sign-on | 7.3 | — |
| redhat software_collections | 1.0 | — |
| redhat enterprise_linux | 8.0 | — |
| redhat enterprise_linux_eus | 8.1 | — |
| redhat enterprise_linux_server | 7.0 | — |
| redhat enterprise_linux_workstation | 7.0 | — |
| oracle graalvm | 19.2.0 | — |
| mcafee web_gateway | 7.7.2.0 ≤ v < 7.7.2.24, 7.8.2.0 ≤ v < 7.8.2.13, 8.1.0 ≤ v < 8.2.0 | 7.7.2.24, 7.8.2.13, 8.2.0 |
| netapp cloud_insights | No range specified | — |
| netapp trident | No range specified | — |
| f5 big-ip_local_traffic_manager | 11.6.1 ≤ v < 11.6.5.1, 12.1.0 ≤ v < 12.1.5.1, 13.1.0 ≤ v < 13.1.3.2, 14.0.0 ≤ v < 14.0.1.1, 14.1.0 ≤ v < 14.1.2.1, 15.0.0 ≤ v < 15.0.1.1 | 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1 |
| nodejs node.js | 8.0.0 ≤ v ≤ 8.8.1, 8.9.0 ≤ v < 8.16.1, 10.0.0 ≤ v ≤ 10.12.0, 10.13.0 ≤ v < 10.16.3, 12.0.0 ≤ v < 12.8.1 | 8.16.1, 10.16.3, 12.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.