Vulnerability Description
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apple | Swiftnio | >= 1.0.0, <= 1.4.0 |
| Apple | Mac Os X | >= 10.12 |
| Canonical | Ubuntu Linux | >= 14.04 |
| Apache | Traffic Server | >= 6.0.0, <= 6.2.3 |
| Debian | Debian Linux | 10.0 |
| Synology | Skynas | - |
| Synology | Diskstation Manager | 6.2 |
| Synology | Vs960Hd Firmware | - |
| Synology | Vs960Hd | - |
| Fedoraproject | Fedora | 29 |
| Opensuse | Leap | 15.0 |
| Redhat | Developer Tools | 1.0 |
| Redhat | Jboss Core Services | 1.0 |
| Redhat | Jboss Enterprise Application Platform | 7.2.0 |
| Redhat | Openshift Container Platform | 3.9 |
| Redhat | Openshift Service Mesh | 1.0 |
| Redhat | Openstack | 14 |
| Redhat | Quay | 3.0.0 |
| Redhat | Single Sign-On | 7.3 |
| Redhat | Software Collections | 1.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.htmlMailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2019/Aug/16Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2019/08/20/1Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2023/10/18/8
- https://access.redhat.com/errata/RHSA-2019:2594Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2661Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2682Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2690Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2726Third Party Advisory
FAQ
What is CVE-2019-9514?
CVE-2019-9514 is a vulnerability with a CVSS score of 7.5 (HIGH). Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that shoul...
How severe is CVE-2019-9514?
CVE-2019-9514 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-9514?
Check the references section above for vendor advisories and patch information. Affected products include: Apple Swiftnio, Apple Mac Os X, Canonical Ubuntu Linux, Apache Traffic Server, Debian Debian Linux.