CVE-2019-9511: Some HTTP/2 implementations are vulnerable to window size…
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 60%
O que os fabricantes declaram (VEX)
Declarações oficiais dos fabricantes em formato CSAF/VEX: se o produto deles está afetado, já corrigido ou descartado — e por quê. É afirmação do fabricante, não juízo do Vexday.
Red Hatdocumento VEX ↗
Afetado
4 produtos (8 componentes)
Red Hat OpenShift Application Runtimes · Red Hat 3scale API Management Platform 2 · Red Hat AMQ Broker 7 · Red Hat JBoss Enterprise Web Server 3
workaround: Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions: 1…
Corrigido
27 produtos (1.600 componentes)
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) · Red Hat JBoss Core Services on RHEL 6 Server · e outros 22
Não afetado
15 produtos (98 componentes) — porque o código vulnerável não está presente no produto
Red Hat OpenShift Container Platform 3.9 · Red Hat OpenShift Container Platform 3.10 · Red Hat OpenShift Container Platform 3.11 · Red Hat Enterprise Linux 8 · CloudForms Management Engine 5 · e outros 10
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
n/a · n/aReferências
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.htmlhttps://access.redhat.com/errata/RHSA-2019:2692https://access.redhat.com/errata/RHSA-2019:2745https://access.redhat.com/errata/RHSA-2019:2746https://access.redhat.com/errata/RHSA-2019:2775https://access.redhat.com/errata/RHSA-2019:2799https://access.redhat.com/errata/RHSA-2019:2925