CVE-2019-9515
High
Description
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
SeverityHigh
CVSS7.5
Exploit probability100. percentile87.3%
Product
Apple Swiftnio
PublishedAug 13, 2019
First seenAug 13, 2019
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- mcafee web_gateway7.7.2.24, 7.8.2.13, 8.2.0 or later
- f5 big-ip_local_traffic_manager11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1 or later
- nodejs node.js8.16.1, 10.16.3, 12.8.1 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- debian.org/security/2019/dsa-4508
- debian.org/security/2019/dsa-4520
- access.redhat.com/errata/RHSA-2019:2766
- access.redhat.com/errata/RHSA-2019:2796
- access.redhat.com/errata/RHSA-2019:2861
- access.redhat.com/errata/RHSA-2019:2925
- access.redhat.com/errata/RHSA-2019:2939
- access.redhat.com/errata/RHSA-2019:2955
- access.redhat.com/errata/RHSA-2019:3892
- access.redhat.com/errata/RHSA-2019:4018
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple swiftnio | 1.0.0 ≤ v ≤ 1.4.0 | — |
| apache traffic_server | 6.0.0 ≤ v ≤ 6.2.3, 7.0.0 ≤ v ≤ 7.1.6, 8.0.0 ≤ v ≤ 8.0.3 | — |
| canonical ubuntu_linux | 16.04, 18.04, 19.04 | — |
| debian debian_linux | 9.0, 10.0 | — |
| synology skynas | No range specified | — |
| synology diskstation_manager | 6.2 | — |
| synology vs960hd_firmware | No range specified | — |
| fedoraproject fedora | 29, 30 | — |
| opensuse leap | 15.0, 15.1 | — |
| redhat jboss_core_services | 1.0 | — |
| redhat jboss_enterprise_application_platform | 7.2.0, 7.3.0 | — |
| redhat openshift_container_platform | 4.1 | — |
| redhat openshift_service_mesh | 1.0 | — |
| redhat openstack | 14 | — |
| redhat quay | 3.0.0 | — |
| redhat single_sign-on | 7.3 | — |
| redhat software_collections | 1.0 | — |
| redhat enterprise_linux | 8.0 | — |
| oracle graalvm | 19.2.0 | — |
| mcafee web_gateway | 7.7.2.0 ≤ v < 7.7.2.24, 7.8.2.0 ≤ v < 7.8.2.13, 8.1.0 ≤ v < 8.2.0 | 7.7.2.24, 7.8.2.13, 8.2.0 |
| f5 big-ip_local_traffic_manager | 11.6.1 ≤ v < 11.6.5.1, 12.1.0 ≤ v < 12.1.5.1, 13.1.0 ≤ v < 13.1.3.2, 14.0.0 ≤ v < 14.0.1.1, 14.1.0 ≤ v < 14.1.2.1, 15.0.0 ≤ v < 15.0.1.1 | 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1 |
| nodejs node.js | 8.0.0 ≤ v ≤ 8.8.1, 8.9.0 ≤ v < 8.16.1, 10.0.0 ≤ v ≤ 10.12.0, 10.13.0 ≤ v < 10.16.3, 12.0.0 ≤ v < 12.8.1 | 8.16.1, 10.16.3, 12.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.