CVE-2019-9512

HIGH

7.5

Description

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published8/13/2019

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

apache:traffic_serverapple:mac_os_xapple:swiftniocanonical:ubuntu_linuxdebian:debian_linuxnodejs:node.js

Weaknesses (CWE)

CWE-400CWE-400

References

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html(cret@cert.org)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html(cret@cert.org)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html(cret@cert.org)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html(cret@cert.org)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html(cret@cert.org)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html(cret@cert.org)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html(cret@cert.org)

http://seclists.org/fulldisclosure/2019/Aug/16(cret@cert.org)

http://www.openwall.com/lists/oss-security/2019/08/20/1(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:2594(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:2661(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:2682(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:2690(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:2726(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:2766(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:2769(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:2796(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:2861(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:2925(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:2939(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:2955(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:2966(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:3131(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:3245(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:3265(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:3892(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:3906(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:4018(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:4019(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:4020(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:4021(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:4040(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:4041(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:4042(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:4045(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:4269(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:4273(cret@cert.org)

https://access.redhat.com/errata/RHSA-2019:4352(cret@cert.org)

https://access.redhat.com/errata/RHSA-2020:0406(cret@cert.org)

https://access.redhat.com/errata/RHSA-2020:0727(cret@cert.org)

https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md(cret@cert.org)

https://kb.cert.org/vuls/id/605641/(cret@cert.org)

https://kc.mcafee.com/corporate/index?page=content&id=SB10296(cret@cert.org)

https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E(cret@cert.org)

https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E(cret@cert.org)

https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E(cret@cert.org)

https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html(cret@cert.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/(cret@cert.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/(cret@cert.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/(cret@cert.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/(cret@cert.org)

https://seclists.org/bugtraq/2019/Aug/24(cret@cert.org)

https://seclists.org/bugtraq/2019/Aug/31(cret@cert.org)

https://seclists.org/bugtraq/2019/Aug/43(cret@cert.org)

https://seclists.org/bugtraq/2019/Sep/18(cret@cert.org)

https://security.netapp.com/advisory/ntap-20190823-0001/(cret@cert.org)

https://security.netapp.com/advisory/ntap-20190823-0004/(cret@cert.org)

https://security.netapp.com/advisory/ntap-20190823-0005/(cret@cert.org)

https://support.f5.com/csp/article/K98053339(cret@cert.org)

https://support.f5.com/csp/article/K98053339?utm_source=f5support&amp%3Butm_medium=RSS(cret@cert.org)

https://usn.ubuntu.com/4308-1/(cret@cert.org)

https://www.debian.org/security/2019/dsa-4503(cret@cert.org)

https://www.debian.org/security/2019/dsa-4508(cret@cert.org)

https://www.debian.org/security/2019/dsa-4520(cret@cert.org)

https://www.synology.com/security/advisory/Synology_SA_19_33(cret@cert.org)

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2019/Aug/16(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2019/08/20/1(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:2594(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:2661(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:2682(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:2690(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:2726(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:2766(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:2769(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:2796(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:2861(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:2925(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:2939(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:2955(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:2966(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:3131(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:3245(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:3265(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:3892(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:3906(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:4018(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:4019(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:4020(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:4021(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:4040(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:4041(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:4042(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:4045(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:4269(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:4273(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:4352(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2020:0406(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2020:0727(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md(af854a3a-2127-422b-91ae-364da2661108)

https://kb.cert.org/vuls/id/605641/(af854a3a-2127-422b-91ae-364da2661108)

https://kc.mcafee.com/corporate/index?page=content&id=SB10296(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/(af854a3a-2127-422b-91ae-364da2661108)

https://seclists.org/bugtraq/2019/Aug/24(af854a3a-2127-422b-91ae-364da2661108)

https://seclists.org/bugtraq/2019/Aug/31(af854a3a-2127-422b-91ae-364da2661108)

https://seclists.org/bugtraq/2019/Aug/43(af854a3a-2127-422b-91ae-364da2661108)

https://seclists.org/bugtraq/2019/Sep/18(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20190823-0001/(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20190823-0004/(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20190823-0005/(af854a3a-2127-422b-91ae-364da2661108)

https://support.f5.com/csp/article/K98053339(af854a3a-2127-422b-91ae-364da2661108)

https://support.f5.com/csp/article/K98053339?utm_source=f5support&amp%3Butm_medium=RSS(af854a3a-2127-422b-91ae-364da2661108)

https://usn.ubuntu.com/4308-1/(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2019/dsa-4503(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2019/dsa-4508(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2019/dsa-4520(af854a3a-2127-422b-91ae-364da2661108)

https://www.synology.com/security/advisory/Synology_SA_19_33(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.