Vulnerability CVE-2019-9518: Information

Description

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.

Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2019-9518
Published: Aug. 14, 2019
Modified: Nov. 7, 2023
Error type identifier: CWE-770

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
nodesisyphus10.17.0-alt120.12.2-alt1ALT-PU-2019-3050-1239770Fixed
nodep1010.17.0-alt116.19.1-alt1ALT-PU-2019-3050-1239770Fixed
nodep914.3.0-alt114.17.2-alt1ALT-PU-2020-2195-1247371Fixed
nodec10f110.17.0-alt116.19.1-alt1ALT-PU-2019-3050-1239770Fixed
nodec9f214.3.0-alt116.19.1-alt0.c9.1ALT-PU-2020-2195-1247371Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
VU#605641
  • Third Party Advisory
  • US Government Resource
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
  • Third Party Advisory
20190814 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0
  • Mailing List
  • Third Party Advisory
20190816 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0
  • Mailing List
  • Third Party Advisory
https://www.synology.com/security/advisory/Synology_SA_19_33
  • Third Party Advisory
https://support.f5.com/csp/article/K46011592
  • Third Party Advisory
https://security.netapp.com/advisory/ntap-20190823-0005/
  • Third Party Advisory
DSA-4520
  • Third Party Advisory
20190910 [SECURITY] [DSA 4520-1] trafficserver security update
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2019:2114
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2019:2115
  • Mailing List
  • Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10296
  • Third Party Advisory
RHSA-2019:2925
  • Third Party Advisory
RHSA-2019:2939
  • Third Party Advisory
RHSA-2019:2955
  • Third Party Advisory
RHSA-2019:3892
  • Third Party Advisory
RHSA-2019:4352
  • Third Party Advisory
RHSA-2020:0727
  • Third Party Advisory
[trafficserver-announce] 20190820 ATS is vulnerable to a HTTP/2 attack with empty frames
    [trafficserver-users] 20190820 ATS is vulnerable to a HTTP/2 attack with empty frames
      [trafficserver-dev] 20190820 ATS is vulnerable to a HTTP/2 attack with empty frames
        FEDORA-2019-5a6a7bc12c
          FEDORA-2019-6a2980de56
            https://support.f5.com/csp/article/K46011592?utm_source=f5support&amp%3Butm_medium=RSS
              [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities
                [cassandra-commits] 20210526 [jira] [Created] (CASSANDRA-16698) Security vulnerability CVE-2019-9518 for Netty
                  [cassandra-commits] 20210526 [jira] [Updated] (CASSANDRA-16698) Security vulnerability CVE-2019-9518 for Netty

                      1. Configuration 1

                        cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:*
                        Running on/with:
                        cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
                        Running on/with:
                        cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*

                        Configuration 2

                        cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
                        Start including
                        8.0.0
                        End including
                        8.0.3
                        cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
                        Start including
                        7.0.0
                        End including
                        7.1.6
                        cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
                        Start including
                        6.0.0
                        End including
                        6.2.3

                        Configuration 3

                        cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
                        cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
                        cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

                        Configuration 4

                        cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
                        cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

                        Configuration 5

                        cpe:2.3:a:synology:skynas:-:*:*:*:*:*:*:*
                        cpe:2.3:a:synology:diskstation_manager:6.2:*:*:*:*:*:*:*

                        Configuration 6

                        cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:*
                        Running on/with:
                        cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:*

                        Configuration 7

                        cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
                        cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

                        Configuration 8

                        cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
                        cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

                        Configuration 9

                        cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*
                        cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:*
                        cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
                        cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*
                        cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*
                        cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:*
                        cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:*

                        Configuration 10

                        cpe:2.3:a:oracle:graalvm:19.2.0:*:*:*:enterprise:*:*:*

                        Configuration 11

                        cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*
                        Start including
                        7.7.2.0
                        End excliding
                        7.7.2.24
                        cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*
                        Start including
                        7.8.2.0
                        End excliding
                        7.8.2.13
                        cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*
                        Start including
                        8.1.0
                        End excliding
                        8.2.0

                        Configuration 12

                        cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
                        Start including
                        8.0.0
                        End including
                        8.8.1
                        cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
                        Start including
                        10.0.0
                        End including
                        10.12.0
                        cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
                        Start including
                        12.0.0
                        End excliding
                        12.8.1
                        cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
                        Start including
                        10.13.0
                        End excliding
                        10.16.3
                        cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
                        Start including
                        8.9.0
                        End excliding
                        8.16.1
                    VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
                    Version: v24.5.1
                    Back to top