CVE-2019-9514: Allocation of Resources Without Limits or Throttling
(updated )
Some HTTP/2 implementations is vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
References
- lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
- seclists.org/fulldisclosure/2019/Aug/16
- www.openwall.com/lists/oss-security/2019/08/20/1
- access.redhat.com/errata/RHSA-2019:2594
- access.redhat.com/errata/RHSA-2019:2661
- access.redhat.com/errata/RHSA-2019:2682
- access.redhat.com/errata/RHSA-2019:2690
- access.redhat.com/errata/RHSA-2019:2726
- access.redhat.com/errata/RHSA-2019:2766
- access.redhat.com/errata/RHSA-2019:2769
- access.redhat.com/errata/RHSA-2019:2796
- access.redhat.com/errata/RHSA-2019:2861
- access.redhat.com/errata/RHSA-2019:2925
- access.redhat.com/errata/RHSA-2019:2939
- access.redhat.com/errata/RHSA-2019:2955
- access.redhat.com/errata/RHSA-2019:2966
- access.redhat.com/errata/RHSA-2019:3131
- access.redhat.com/errata/RHSA-2019:3245
- access.redhat.com/errata/RHSA-2019:3265
- access.redhat.com/errata/RHSA-2019:3892
- access.redhat.com/errata/RHSA-2019:3906
- access.redhat.com/errata/RHSA-2019:4018
- access.redhat.com/errata/RHSA-2019:4019
- access.redhat.com/errata/RHSA-2019:4020
- access.redhat.com/errata/RHSA-2019:4021
- access.redhat.com/errata/RHSA-2019:4040
- access.redhat.com/errata/RHSA-2019:4041
- access.redhat.com/errata/RHSA-2019:4042
- access.redhat.com/errata/RHSA-2019:4045
- access.redhat.com/errata/RHSA-2019:4269
- access.redhat.com/errata/RHSA-2019:4273
- access.redhat.com/errata/RHSA-2019:4352
- access.redhat.com/errata/RHSA-2020:0406
- access.redhat.com/errata/RHSA-2020:0727
- github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- github.com/advisories/GHSA-39qc-96h7-956f
- go.dev/cl/190137
- go.dev/issue/33606
- go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5
- groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ
- kb.cert.org/vuls/id/605641/
- kc.mcafee.com/corporate/index?page=content&id=SB10296
- lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04@%3Cusers.trafficserver.apache.org%3E
- lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19@%3Cannounce.trafficserver.apache.org%3E
- lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7@%3Cdev.trafficserver.apache.org%3E
- lists.debian.org/debian-lts-announce/2020/12/msg00011.html
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/
- nvd.nist.gov/vuln/detail/CVE-2019-9514
- pkg.go.dev/vuln/GO-2022-0536
- seclists.org/bugtraq/2019/Aug/24
- seclists.org/bugtraq/2019/Aug/31
- seclists.org/bugtraq/2019/Aug/43
- seclists.org/bugtraq/2019/Sep/18
- security.netapp.com/advisory/ntap-20190823-0001/
- security.netapp.com/advisory/ntap-20190823-0004/
- security.netapp.com/advisory/ntap-20190823-0005/
- support.f5.com/csp/article/K01988340
- support.f5.com/csp/article/K01988340?utm_source=f5support&utm_medium=RSS
- usn.ubuntu.com/4308-1/
- www.debian.org/security/2019/dsa-4503
- www.debian.org/security/2019/dsa-4508
- www.debian.org/security/2019/dsa-4520
- www.debian.org/security/2020/dsa-4669
- www.synology.com/security/advisory/Synology_SA_19_33
Code Behaviors & Features
Detect and mitigate CVE-2019-9514 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →