CVE-2019-9511
high · 7.5Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
7.5
CVSS
59.5%
EPSS (exploit prob.)
99th
EPSS percentile
2019-08-13
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400CWE-770
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| apple | swiftnio | >= 1.0.0, <= 1.4.0 |
| apple | mac_os_x | >= 10.12 |
| canonical | ubuntu_linux | >= 14.04 |
| apache | traffic_server | >= 6.0.0, <= 6.2.3 |
| apache | traffic_server | >= 7.0.0, <= 7.1.6 |
| apache | traffic_server | >= 8.0.0, <= 8.0.3 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 19.04 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| synology | skynas | all versions |
| synology | diskstation_manager | 6.2 |
| synology | vs960hd_firmware | all versions |
| synology | vs960hd | all versions |
| fedoraproject | fedora | 29 |
| fedoraproject | fedora | 30 |
| opensuse | leap | 15.0 |
| opensuse | leap | 15.1 |
| redhat | jboss_core_services | 1.0 |
| redhat | jboss_enterprise_application_platform | 7.2.0 |
| redhat | jboss_enterprise_application_platform | 7.3.0 |
| redhat | openshift_service_mesh | 1.0 |
| redhat | quay | 3.0.0 |
| redhat | software_collections | 1.0 |
| redhat | enterprise_linux | 8.0 |
| oracle | graalvm | 19.2.0 |
| mcafee | web_gateway | >= 7.7.2.0, < 7.7.2.24 |
| mcafee | web_gateway | >= 7.8.2.0, < 7.8.2.13 |
| mcafee | web_gateway | >= 8.1.0, < 8.2.0 |
| f5 | nginx | >= 1.9.5, < 1.16.1 |
| f5 | nginx | >= 1.17.0, <= 1.17.2 |
| oracle | enterprise_communications_broker | 3.1.0 |
| oracle | enterprise_communications_broker | 3.2.0 |
| nodejs | node.js | >= 8.0.0, <= 8.8.1 |
| nodejs | node.js | >= 8.9.0, < 8.16.1 |
| nodejs | node.js | >= 10.0.0, <= 10.12.0 |
| nodejs | node.js | >= 10.13.0, < 10.16.3 |
| nodejs | node.js | >= 12.0.0, < 12.8.1 |
Check a specific version with /api/v1/cve/match.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html
- https://access.redhat.com/errata/RHSA-2019:2692
- https://access.redhat.com/errata/RHSA-2019:2745
- https://access.redhat.com/errata/RHSA-2019:2746
- https://access.redhat.com/errata/RHSA-2019:2775
- https://access.redhat.com/errata/RHSA-2019:2799
- https://access.redhat.com/errata/RHSA-2019:2925
- https://access.redhat.com/errata/RHSA-2019:2939
- https://access.redhat.com/errata/RHSA-2019:2949
- https://access.redhat.com/errata/RHSA-2019:2955
- https://access.redhat.com/errata/RHSA-2019:2966
- https://access.redhat.com/errata/RHSA-2019:3041
- https://access.redhat.com/errata/RHSA-2019:3932
- https://access.redhat.com/errata/RHSA-2019:3933
- https://access.redhat.com/errata/RHSA-2019:3935
- https://access.redhat.com/errata/RHSA-2019:4018
- https://access.redhat.com/errata/RHSA-2019:4019
- https://access.redhat.com/errata/RHSA-2019:4020
- https://access.redhat.com/errata/RHSA-2019:4021
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2019-9511