Vulnerability Description
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apple | Swiftnio | >= 1.0.0, <= 1.4.0 |
| Apple | Mac Os X | >= 10.12 |
| Canonical | Ubuntu Linux | >= 14.04 |
| Apache | Traffic Server | >= 6.0.0, <= 6.2.3 |
| Debian | Debian Linux | 9.0 |
| Synology | Skynas | - |
| Synology | Diskstation Manager | 6.2 |
| Synology | Vs960Hd Firmware | - |
| Synology | Vs960Hd | - |
| Fedoraproject | Fedora | 29 |
| Opensuse | Leap | 15.0 |
| Redhat | Jboss Core Services | 1.0 |
| Redhat | Jboss Enterprise Application Platform | 7.2.0 |
| Redhat | Openshift Service Mesh | 1.0 |
| Redhat | Quay | 3.0.0 |
| Redhat | Software Collections | 1.0 |
| Redhat | Enterprise Linux | 8.0 |
| Oracle | Graalvm | 19.2.0 |
| Mcafee | Web Gateway | >= 7.7.2.0, < 7.7.2.24 |
| F5 | Nginx | >= 1.9.5, < 1.16.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.htmlMailing ListThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2692Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2745Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2746Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2775Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2799Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2925Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2939Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2949Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2955Third Party Advisory
FAQ
What is CVE-2019-9511?
CVE-2019-9511 is a vulnerability with a CVSS score of 7.5 (HIGH). Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data ...
How severe is CVE-2019-9511?
CVE-2019-9511 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-9511?
Check the references section above for vendor advisories and patch information. Affected products include: Apple Swiftnio, Apple Mac Os X, Canonical Ubuntu Linux, Apache Traffic Server, Debian Debian Linux.