CVE-2019-9511highCWE-400

CVE-2019-9511: Some HTTP/2 implementations are vulnerable to window size…

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear nodejs+ Monitorear nodejs

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 60%
Lo que declaran los fabricantes (VEX)

Declaraciones oficiales de los fabricantes en formato CSAF/VEX: si su producto está afectado, ya corregido o descartado — y por qué. Es afirmación del fabricante, no juicio de Vexday.

Red Hatdocumento VEX ↗
Afectado
4 productos (8 componentes)
Red Hat OpenShift Application Runtimes · Red Hat 3scale API Management Platform 2 · Red Hat AMQ Broker 7 · Red Hat JBoss Enterprise Web Server 3
workaround: Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions: 1…
Corregido
27 productos (1600 componentes)
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) · Red Hat JBoss Core Services on RHEL 6 Server · y otros 22
corrección ↗
No afectado
15 productos (98 componentes) — porque el código vulnerable no está presente en el producto
Red Hat OpenShift Container Platform 3.9 · Red Hat OpenShift Container Platform 3.10 · Red Hat OpenShift Container Platform 3.11 · Red Hat Enterprise Linux 8 · CloudForms Management Engine 5 · y otros 10
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
n/a · n/a