Vulnerability Description
Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent from the client using the HTTP/2 protocol. Users should upgrade to Apache Traffic Server 7.1.7, 8.0.4, or later versions.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Traffic Server | < 7.1.7 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d
- https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536
- https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c921
- https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d
- https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536
- https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c921
FAQ
What is CVE-2019-10079?
CVE-2019-10079 is a vulnerability with a CVSS score of 7.5 (HIGH). Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent from the client using the HTTP/2 protocol....
How severe is CVE-2019-10079?
CVE-2019-10079 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-10079?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Traffic Server.