CVE-2019-9513
13.08.2019, 21:15
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.Enginsight
| Vendor | Product | Version |
|---|---|---|
| apple | swiftnio | 1.0.0 ≤ 𝑥 ≤ 1.4.0 |
| apache | traffic_server | 6.0.0 ≤ 𝑥 ≤ 6.2.3 |
| apache | traffic_server | 7.0.0 ≤ 𝑥 ≤ 7.1.6 |
| apache | traffic_server | 8.0.0 ≤ 𝑥 ≤ 8.0.3 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 19.04 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| synology | skynas | - |
| synology | diskstation_manager | 6.2 |
| synology | vs960hd_firmware | - |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| opensuse | leap | 15.0 |
| opensuse | leap | 15.1 |
| redhat | jboss_core_services | 1.0 |
| redhat | jboss_enterprise_application_platform | 7.2.0 |
| redhat | jboss_enterprise_application_platform | 7.3.0 |
| redhat | openshift_service_mesh | 1.0 |
| redhat | quay | 3.0.0 |
| redhat | software_collections | 1.0 |
| redhat | enterprise_linux | 8.0 |
| oracle | graalvm | 19.2.0 |
| mcafee | web_gateway | 7.7.2.0 ≤ 𝑥 < 7.7.2.24 |
| mcafee | web_gateway | 7.8.2.0 ≤ 𝑥 < 7.8.2.13 |
| mcafee | web_gateway | 8.1.0 ≤ 𝑥 < 8.2.0 |
| f5 | nginx | 1.9.5 ≤ 𝑥 < 1.16.1 |
| f5 | nginx | 1.17.0 ≤ 𝑥 ≤ 1.17.2 |
| oracle | enterprise_communications_broker | 3.1.0 |
| oracle | enterprise_communications_broker | 3.2.0 |
| nodejs | node.js | 8.0.0 ≤ 𝑥 ≤ 8.8.1 |
| nodejs | node.js | 8.9.0 ≤ 𝑥 < 8.16.1 |
| nodejs | node.js | 10.0.0 ≤ 𝑥 ≤ 10.12.0 |
| nodejs | node.js | 10.13.0 ≤ 𝑥 < 10.16.3 |
| nodejs | node.js | 12.0.0 ≤ 𝑥 < 12.8.1 |
𝑥
= Vulnerable software versions
Debian Releases
Debian Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| nghttp2 |
| ||||||||||||||||
| nginx |
| ||||||||||||||||
| nodejs |
|
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| nghttp2 |
| ||||||||||||||||||||||||||||||
| nginx |
| ||||||||||||||||||||||||||||||
| nodejs |
|
References