CVE-2019-9516
medium · 6.5Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
6.5
CVSS
56.3%
EPSS (exploit prob.)
99th
EPSS percentile
2019-08-13
Published
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400CWE-770
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| apple | swiftnio | >= 1.0.0, <= 1.4.0 |
| apple | mac_os_x | >= 10.12 |
| canonical | ubuntu_linux | >= 14.04 |
| apache | traffic_server | >= 6.0.0, <= 6.2.3 |
| apache | traffic_server | >= 7.0.0, <= 7.1.6 |
| apache | traffic_server | >= 8.0.0, <= 8.0.3 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 19.04 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| fedoraproject | fedora | 30 |
| synology | skynas | all versions |
| synology | diskstation_manager | 6.2 |
| synology | vs960hd_firmware | all versions |
| synology | vs960hd | all versions |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| fedoraproject | fedora | 29 |
| fedoraproject | fedora | 30 |
| fedoraproject | fedora | 32 |
| opensuse | leap | 15.0 |
| opensuse | leap | 15.1 |
| redhat | jboss_core_services | 1.0 |
| redhat | jboss_enterprise_application_platform | 7.2.0 |
| redhat | jboss_enterprise_application_platform | 7.3.0 |
| redhat | openshift_service_mesh | 1.0 |
| redhat | quay | 3.0.0 |
| redhat | software_collections | 1.0 |
| redhat | enterprise_linux | 8.0 |
| oracle | graalvm | 19.2.0 |
| mcafee | web_gateway | >= 7.7.2.0, < 7.7.2.24 |
| mcafee | web_gateway | >= 7.8.2.0, < 7.8.2.13 |
| mcafee | web_gateway | >= 8.1.0, < 8.2.0 |
| f5 | nginx | >= 1.9.5, < 1.16.1 |
| f5 | nginx | >= 1.17.0, <= 1.17.2 |
| nodejs | node.js | >= 8.0.0, < 8.16.1 |
| nodejs | node.js | >= 10.0.0, < 10.16.3 |
| nodejs | node.js | >= 12.0.0, < 12.8.1 |
Check a specific version with /api/v1/cve/match.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html
- http://seclists.org/fulldisclosure/2019/Aug/16
- https://access.redhat.com/errata/RHSA-2019:2745
- https://access.redhat.com/errata/RHSA-2019:2746
- https://access.redhat.com/errata/RHSA-2019:2775
- https://access.redhat.com/errata/RHSA-2019:2799
- https://access.redhat.com/errata/RHSA-2019:2925
- https://access.redhat.com/errata/RHSA-2019:2939
- https://access.redhat.com/errata/RHSA-2019:2946
- https://access.redhat.com/errata/RHSA-2019:2950
- https://access.redhat.com/errata/RHSA-2019:2955
- https://access.redhat.com/errata/RHSA-2019:2966
- https://access.redhat.com/errata/RHSA-2019:3932
- https://access.redhat.com/errata/RHSA-2019:3933
- https://access.redhat.com/errata/RHSA-2019:3935
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- https://kb.cert.org/vuls/id/605641/
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2019-9516