CVE-2019-9518
High
Description
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.
SeverityHigh
CVSS7.5
Exploit probability98. percentile25.4%
Product
Apple Swiftnio
PublishedAug 13, 2019
First seenAug 13, 2019
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- mcafee web_gateway7.7.2.24, 7.8.2.13, 8.2.0 or later
- nodejs node.js8.16.1, 10.16.3, 12.8.1 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- debian.org/security/2019/dsa-4520
- access.redhat.com/errata/RHSA-2019:2925
- access.redhat.com/errata/RHSA-2019:2939
- access.redhat.com/errata/RHSA-2019:2955
- access.redhat.com/errata/RHSA-2019:3892
- access.redhat.com/errata/RHSA-2019:4352
- access.redhat.com/errata/RHSA-2020:0727
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple swiftnio | 1.0.0 ≤ v ≤ 1.4.0 | — |
| apache traffic_server | 6.0.0 ≤ v ≤ 6.2.3, 7.0.0 ≤ v ≤ 7.1.6, 8.0.0 ≤ v ≤ 8.0.3 | — |
| canonical ubuntu_linux | 16.04, 18.04, 19.04 | — |
| debian debian_linux | 9.0, 10.0 | — |
| synology skynas | No range specified | — |
| synology diskstation_manager | 6.2 | — |
| synology vs960hd_firmware | No range specified | — |
| fedoraproject fedora | 29, 30 | — |
| opensuse leap | 15.0, 15.1 | — |
| redhat jboss_core_services | 1.0 | — |
| redhat jboss_enterprise_application_platform | 7.2.0, 7.3.0 | — |
| redhat openshift_service_mesh | 1.0 | — |
| redhat quay | 3.0.0 | — |
| redhat software_collections | 1.0 | — |
| redhat enterprise_linux | 8.0 | — |
| oracle graalvm | 19.2.0 | — |
| mcafee web_gateway | 7.7.2.0 ≤ v < 7.7.2.24, 7.8.2.0 ≤ v < 7.8.2.13, 8.1.0 ≤ v < 8.2.0 | 7.7.2.24, 7.8.2.13, 8.2.0 |
| nodejs node.js | 8.0.0 ≤ v ≤ 8.8.1, 8.9.0 ≤ v < 8.16.1, 10.0.0 ≤ v ≤ 10.12.0, 10.13.0 ≤ v < 10.16.3, 12.0.0 ≤ v < 12.8.1 | 8.16.1, 10.16.3, 12.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.