CVE-2019-9517
CVE-2019-9517 · Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Esta página muestra una selección de datos de las fuentes. Consulte los avisos enlazados para ver la descripción completa y las versiones afectadas.
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.
CVSS 7.5 · Alta · EPSS 27,9% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
n/a
- Versiones
- n/a: Afectada
Sin corrección publicada
apache2 Debian:12
- Intervalos de versiones afectados
- ECOSYSTEM: < 2.4.41-1
Actualiza a 2.4.41-1
apache2 Debian:13
- Intervalos de versiones afectados
- ECOSYSTEM: < 2.4.41-1
Actualiza a 2.4.41-1
apache2 Debian:14
- Intervalos de versiones afectados
- ECOSYSTEM: < 2.4.41-1
Actualiza a 2.4.41-1
apache2 Ubuntu:18.04:LTS
- Versiones
- 2.4.27-2ubuntu3
- 2.4.29-1ubuntu1
- 2.4.29-1ubuntu2
- 2.4.29-1ubuntu3
- 2.4.29-1ubuntu4
- 2.4.29-1ubuntu4.1
- 2.4.29-1ubuntu4.2
- 2.4.29-1ubuntu4.3
- 2.4.29-1ubuntu4.4
- 2.4.29-1ubuntu4.5
- 2.4.29-1ubuntu4.6
- 2.4.29-1ubuntu4.7
- 2.4.29-1ubuntu4.8
- Intervalos de versiones afectados
- ECOSYSTEM: < 2.4.29-1ubuntu4.10
Actualiza a 2.4.29-1ubuntu4.10
Fuentes originales
- https://kb.cert.org/vuls/id/605641/
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- https://lists.apache.org/thread.html/4610762456644181b267c846423b3a990bd4aaea1886ecc7d51febdb%40%3Cannounce.httpd.apache.org%3E
- https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
- http://www.openwall.com/lists/oss-security/2019/08/15/7
- https://lists.apache.org/thread.html/ec97fdfc1a859266e56fef084353a34e0a0b08901b3c1aa317a43c8c%40%3Cdev.httpd.apache.org%3E
- https://lists.apache.org/thread.html/d89f999e26dfb1d50f247ead1fe8538014eb412b2dbe5be4b1a9ef50%40%3Cdev.httpd.apache.org%3E
- https://www.synology.com/security/advisory/Synology_SA_19_33
- https://support.f5.com/csp/article/K02591030
- https://security.netapp.com/advisory/ntap-20190823-0005/
- https://security.netapp.com/advisory/ntap-20190823-0003/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- https://www.debian.org/security/2019/dsa-4509
- https://seclists.org/bugtraq/2019/Aug/47
- https://usn.ubuntu.com/4113-1/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.html
- https://security.netapp.com/advisory/ntap-20190905-0003/
- https://security.gentoo.org/glsa/201909-04
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-9517