CVE-2019-9517
High
Description
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.
SeverityHigh
CVSS7.5
Exploit probability98. percentile27.9%
Product
Apache Http Server
PublishedAug 13, 2019
First seenAug 13, 2019
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- apache http_server2.4.40 or later
- mcafee web_gateway7.7.2.24, 7.8.2.13, 8.2.0 or later
- nodejs node.js8.16.1, 10.16.3, 12.8.1 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- debian.org/security/2019/dsa-4509
- usn.ubuntu.com/4113-1/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/
- security.gentoo.org/glsa/201909-04
- access.redhat.com/errata/RHSA-2019:2893
- access.redhat.com/errata/RHSA-2019:2925
- access.redhat.com/errata/RHSA-2019:2939
- access.redhat.com/errata/RHSA-2019:2946
- access.redhat.com/errata/RHSA-2019:2950
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache http_server | 2.4.20 ≤ v < 2.4.40 | 2.4.40 |
| apple swiftnio | 1.0.0 ≤ v ≤ 1.4.0 | — |
| apache traffic_server | 6.0.0 ≤ v ≤ 6.2.3, 7.0.0 ≤ v ≤ 7.1.6, 8.0.0 ≤ v ≤ 8.0.3 | — |
| canonical ubuntu_linux | 16.04, 18.04, 19.04 | — |
| debian debian_linux | 9.0, 10.0 | — |
| synology skynas | No range specified | — |
| synology diskstation_manager | 6.2 | — |
| synology vs960hd_firmware | No range specified | — |
| fedoraproject fedora | 29, 30 | — |
| opensuse leap | 15.0, 15.1 | — |
| redhat jboss_core_services | 1.0 | — |
| redhat jboss_enterprise_application_platform | 7.2.0, 7.3.0 | — |
| redhat openshift_service_mesh | 1.0 | — |
| redhat quay | 3.0.0 | — |
| redhat software_collections | 1.0 | — |
| redhat enterprise_linux | 8.0 | — |
| oracle communications_element_manager | 8.0.0, 8.1.0, 8.1.1, 8.2.0 | — |
| oracle graalvm | 19.2.0 | — |
| oracle instantis_enterprisetrack | 17.1 ≤ v ≤ 17.3 | — |
| oracle retail_xstore_point_of_service | 7.1 | — |
| mcafee web_gateway | 7.7.2.0 ≤ v < 7.7.2.24, 7.8.2.0 ≤ v < 7.8.2.13, 8.1.0 ≤ v < 8.2.0 | 7.7.2.24, 7.8.2.13, 8.2.0 |
| netapp clustered_data_ontap | No range specified | — |
| nodejs node.js | 8.0.0 ≤ v ≤ 8.8.1, 8.9.0 ≤ v < 8.16.1, 10.0.0 ≤ v ≤ 10.12.0, 10.13.0 ≤ v < 10.16.3, 12.0.0 ≤ v < 12.8.1 | 8.16.1, 10.16.3, 12.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.