CVE-2019-9512

Опубликовано: 13 авг. 2019

Источник: nvd

CVSS3: 7.5

CVSS2: 7.8

EPSS Средний

Описание

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2019/Aug/16
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/08/20/1
Mailing List
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2594
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2661
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2682
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2690
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2726
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2766
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2769
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2796
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2861
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2925
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2939
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:*

Версия от 1.0.0 (включая) до 1.4.0 (включая)

Одно из

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

Версия от 10.12 (включая)

cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*

Версия от 14.04 (включая)

Конфигурация 2

Одно из

cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 6.2.3 (включая)

cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*

Версия от 7.0.0 (включая) до 7.1.6 (включая)

cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*

Версия от 8.0.0 (включая) до 8.0.3 (включая)

Конфигурация 3

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Версия от 8.0.0 (включая) до 8.8.1 (включая)

cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*

Версия от 8.9.0 (включая) до 8.16.1 (исключая)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Версия от 10.0.0 (включая) до 10.12.0 (включая)

cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*

Версия от 10.13.0 (включая) до 10.16.3 (исключая)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Версия от 12.0.0 (включая) до 12.8.1 (исключая)

EPSS

Процентиль: 95%

0.21241

Средний

7.5 High

CVSS3

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-400

Связанные уязвимости

CVE-2019-9512

CVSS3: 7.5

ubuntu

почти 6 лет назад

CVE-2019-9512

CVSS3: 7.5

redhat

почти 6 лет назад

CVE-2019-9512

CVSS3: 7.5

msrc

почти 6 лет назад

HTTP/2 Server Denial of Service Vulnerability

CVE-2019-9512

CVSS3: 7.5

debian

почти 6 лет назад

Some HTTP/2 implementations are vulnerable to ping floods, potentially ...

GHSA-hgr8-6h9x-f7q9

CVSS3: 7.5

github

около 3 лет назад

golang.org/x/net/http vulnerable to ping floods

EPSS

Процентиль: 95%

0.21241

Средний

7.5 High

CVSS3

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-400