Vulnerability CVE-2019-9512: Information

Description

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2019-9512

Published: Aug. 14, 2019

Modified: Nov. 7, 2023

Error type identifier: CWE-400

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
golang	sisyphus	1.12.9-alt1	1.22.4-alt1	ALT-PU-2019-2494-1	236282	Fixed
golang	p10	1.12.9-alt1	1.21.11-alt1	ALT-PU-2019-2494-1	236282	Fixed
golang	p9	1.12.9-alt1	1.15.15-alt1	ALT-PU-2019-2495-1	236286	Fixed
golang	p8	1.12.9-alt1	1.12.17-alt1	ALT-PU-2019-2807-1	236875	Fixed
golang	c10f1	1.12.9-alt1	1.21.10-alt1	ALT-PU-2019-2494-1	236282	Fixed
golang	c9f2	1.12.9-alt1	1.20.13-alt1	ALT-PU-2019-2495-1	236286	Fixed
golang	p11	1.12.9-alt1	1.22.4-alt1	ALT-PU-2019-2494-1	236282	Fixed
kubernetes	p9	1.15.4-alt1	1.20.2-alt1	ALT-PU-2019-2794-1	238219	Fixed
node	sisyphus	10.17.0-alt1	20.13.1-alt1	ALT-PU-2019-3050-1	239770	Fixed
node	p10	10.17.0-alt1	16.19.1-alt1	ALT-PU-2019-3050-1	239770	Fixed
node	p9	14.3.0-alt1	14.17.2-alt1	ALT-PU-2020-2195-1	247371	Fixed
node	c10f1	10.17.0-alt1	16.19.1-alt1	ALT-PU-2019-3050-1	239770	Fixed
node	c9f2	14.3.0-alt1	16.19.1-alt0.c9.1	ALT-PU-2020-2195-1	247371	Fixed
node	p11	10.17.0-alt1	20.13.1-alt1	ALT-PU-2019-3050-1	239770	Fixed
traefik	sisyphus	1.7.14-alt1	2.11.3-alt1	ALT-PU-2019-2525-1	236482	Fixed
traefik	p10	1.7.14-alt1	2.10.7-alt1	ALT-PU-2019-2525-1	236482	Fixed
traefik	p9	1.7.14-alt1	2.4.3-alt1	ALT-PU-2019-2564-1	236696	Fixed
traefik	c10f1	1.7.14-alt1	2.10.7-alt1	ALT-PU-2019-2525-1	236482	Fixed
traefik	c9f2	1.7.14-alt1	2.10.3-alt1	ALT-PU-2019-2564-1	236696	Fixed
traefik	p11	1.7.14-alt1	2.11.3-alt1	ALT-PU-2019-2525-1	236482	Fixed

References to Advisories, Solutions, and Tools

Hyperlink	Resource
VU#605641	Third Party Advisory US Government Resource
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md	Third Party Advisory
20190814 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0	Mailing List Third Party Advisory
20190816 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0	Mailing List Third Party Advisory
https://www.synology.com/security/advisory/Synology_SA_19_33	Third Party Advisory
20190819 [SECURITY] [DSA 4503-1] golang-1.11 security update	Mailing List Third Party Advisory
DSA-4503	Third Party Advisory
https://support.f5.com/csp/article/K98053339	Third Party Advisory
[oss-security] 20190819 [ANNOUNCE] Security release of Kubernetes v1.15.3, v1.14.6, v1.13.10 - CVE-2019-9512 and CVE-2019-9514	Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20190823-0004/	Third Party Advisory
https://security.netapp.com/advisory/ntap-20190823-0005/	Third Party Advisory
https://security.netapp.com/advisory/ntap-20190823-0001/	Third Party Advisory
openSUSE-SU-2019:2000	Mailing List Third Party Advisory
20190825 [SECURITY] [DSA 4508-1] h2o security update	Mailing List Third Party Advisory
DSA-4508	Third Party Advisory
openSUSE-SU-2019:2056	Mailing List Third Party Advisory
openSUSE-SU-2019:2072	Mailing List Third Party Advisory
openSUSE-SU-2019:2085	Mailing List Third Party Advisory
RHSA-2019:2682	Third Party Advisory
DSA-4520	Third Party Advisory
RHSA-2019:2726	Third Party Advisory
20190910 [SECURITY] [DSA 4520-1] trafficserver security update	Mailing List Third Party Advisory
RHSA-2019:2594	Third Party Advisory
openSUSE-SU-2019:2114	Mailing List Third Party Advisory
openSUSE-SU-2019:2115	Mailing List Third Party Advisory
RHSA-2019:2661	Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10296	Third Party Advisory
RHSA-2019:2690	Third Party Advisory
RHSA-2019:2766	Third Party Advisory
openSUSE-SU-2019:2130	Mailing List Third Party Advisory
RHSA-2019:2796	Third Party Advisory
RHSA-2019:2861	Third Party Advisory
RHSA-2019:2925	Third Party Advisory
RHSA-2019:2939	Third Party Advisory
RHSA-2019:2955	Third Party Advisory
RHSA-2019:2966	Third Party Advisory
RHSA-2019:3131	Third Party Advisory
RHSA-2019:2769	Third Party Advisory
RHSA-2019:3245	Third Party Advisory
RHSA-2019:3265	Third Party Advisory
RHSA-2019:3892	Third Party Advisory
RHSA-2019:3906	Third Party Advisory
RHSA-2019:4018	Third Party Advisory
RHSA-2019:4020	Third Party Advisory
RHSA-2019:4019	Third Party Advisory
RHSA-2019:4021	Third Party Advisory
RHSA-2019:4040	Third Party Advisory
RHSA-2019:4042	Third Party Advisory
RHSA-2019:4041	Third Party Advisory
RHSA-2019:4045	Third Party Advisory
RHSA-2019:4269	Third Party Advisory
RHSA-2019:4273	Third Party Advisory
RHSA-2019:4352	Third Party Advisory
RHSA-2020:0406	Third Party Advisory
RHSA-2020:0727	Third Party Advisory
USN-4308-1	Third Party Advisory
[debian-lts-announce] 20201208 [SECURITY] [DLA 2485-1] golang-golang-x-net-dev security update	Mailing List Third Party Advisory
[trafficserver-dev] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacks
[trafficserver-users] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacks
[trafficserver-announce] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacks
FEDORA-2019-5a6a7bc12c
FEDORA-2019-6a2980de56
FEDORA-2019-55d101a740
FEDORA-2019-65db7ad6c7
https://support.f5.com/csp/article/K98053339?utm_source=f5support&amp%3Butm_medium=RSS

Affected configurations:
1. Configuration 1
  cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:*
  Running on/with:
  cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
  Running on/with:
  cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
  
  Configuration 2
  cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
  Start including
  8.0.0
  End including
  8.0.3
  cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
  Start including
  7.0.0
  End including
  7.1.6
  cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
  Start including
  6.0.0
  End including
  6.2.3
  
  Configuration 3
  cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  
  Configuration 4
  cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
  Start including
  8.0.0
  End including
  8.8.1
  cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
  Start including
  10.0.0
  End including
  10.12.0
  cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
  Start including
  12.0.0
  End excliding
  12.8.1
  cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
  Start including
  10.13.0
  End excliding
  10.16.3
  cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
  Start including
  8.9.0
  End excliding
  8.16.1

Version: v24.5.3

Vulnerability CVE-2019-9512: Information

Description

Fixed packages

References to Advisories, Solutions, and Tools

Configuration 1

Configuration 2

Configuration 3

Configuration 4