Vulnerability Description
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apple | Swiftnio | >= 1.0.0, <= 1.4.0 |
| Apple | Mac Os X | >= 10.12 |
| Canonical | Ubuntu Linux | >= 14.04 |
| Apache | Http Server | >= 2.4.20, < 2.4.40 |
| Apache | Traffic Server | >= 6.0.0, <= 6.2.3 |
| Debian | Debian Linux | 9.0 |
| Synology | Skynas | - |
| Synology | Diskstation Manager | 6.2 |
| Synology | Vs960Hd Firmware | - |
| Synology | Vs960Hd | - |
| Fedoraproject | Fedora | 29 |
| Opensuse | Leap | 15.0 |
| Redhat | Jboss Core Services | 1.0 |
| Redhat | Jboss Enterprise Application Platform | 7.2.0 |
| Redhat | Openshift Service Mesh | 1.0 |
| Redhat | Quay | 3.0.0 |
| Redhat | Software Collections | 1.0 |
| Redhat | Enterprise Linux | 8.0 |
| Oracle | Communications Element Manager | 8.0.0 |
| Oracle | Graalvm | 19.2.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlMailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2019/08/15/7Mailing ListThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2893Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2925Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2939Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2946Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2949Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2950Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2955Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3932Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3933Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3935Third Party Advisory
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-partyThird Party Advisory
FAQ
What is CVE-2019-9517?
CVE-2019-9517 is a vulnerability with a CVSS score of 7.5 (HIGH). Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constr...
How severe is CVE-2019-9517?
CVE-2019-9517 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-9517?
Check the references section above for vendor advisories and patch information. Affected products include: Apple Swiftnio, Apple Mac Os X, Canonical Ubuntu Linux, Apache Http Server, Apache Traffic Server.