Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Multiple Denial of Service (DoS) Vulnerabilities in HTTP/2 Disclosed (CVE-2019-9511, CVE-2019-9518)

A variety of Denial of Service vulnerabilities were found in third-party implementations of HTTP/2.

Background

On August 13, researchers at Netflix published an advisory for their GitHub page detailing their discovery of eight vulnerabilities in the HTTP/2 protocol implementations by third parties. The vulnerabilities were primarily discovered by Jonathan Looney, Engineering Manager at Netflix, with one vulnerability, CVE-2019-9518, discovered by Piotr Sikora, Senior Software Engineer at Google.

Multiple Denial of Service (DoS) Vulnerabilities in HTTP/2 Disclosed (CVE-2019-9511, CVE-2019-9518)

Image Credit: Cloudflare

Analysis

A client (“the attacker”) can exploit these HTTP/2 vulnerabilities by sending specially crafted requests to vulnerable servers. While these requests will vary, a vulnerable server will attempt to process the request and attempt to send a response. However, the malicious client ignores the response, leading to excess consumption of resources, which would result in a denial of service (DoS).

The following are the eight vulnerabilities and the associated nicknames given to them in the Netflix advisory.

CVE ID Nickname
CVE-2019-9511 “Data Dribble”
CVE-2019-9512 “Ping Flood”
CVE-2019-9513 “Resource Loop”
CVE-2019-9514 “Reset Flood”
CVE-2019-9515 “Settings Flood”
CVE-2019-9516 “0-Length Headers Leak”
CVE-2019-9517 “Internal Data Buffering”
CVE-2019-9518 “Empty Frames Flood”

Proof of concept

At the time the blog was published, no proof-of-concept code was available.

Solution

To immediately address the vulnerabilities, Netflix’s advisory suggests disabling HTTP/2 support, but cautions that this could either result in performance degradation or not be feasible. Software vendors are in the process of publishing patches for these vulnerabilities. Initial reports from vendors can be found below:

Vendor Link(s) Source
Akamai HTTP2 Vulnerabilities Blog
Ambassador (API Gateway) Multiple HTTP/2 vulnerabilities in Envoy Proxy Blog
Apache Traffic Server (ATS) [ANNOUNCE] Apache Traffic Server is vulnerable to various HTTP/2 attacks Mailing List
Cloudflare On the recent HTTP/2 DoS attacks Blog
Envoy (Proxy) Version 1.11.1 History Changelog
Google (Golang) [security] Go 1.12.8 and Go 1.11.13 are released Forum Posting
Microsoft CVE-2019-9511, CVE-2019-9512, CVE-2019-9513, CVE-2019-9514, CVE-2019-9518 Advisory
Netty Project Netty 4.1.39.Final released Blog
nghttp2 nghttp2 v1.39.2 Release Notes Software Release
Nginx NGINX Updates Mitigate the August 2019 HTTP/2 Vulnerabilities Blog
Node.js August 2019 Security Releases Blog
Swift About the security content of SwiftNIO HTTP/2 1.5.0 Advisory

Customers using these software applications are encouraged to update to the patched versions as soon as possible.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.

Get more information

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 60-day trial of Tenable.io .

Subscribe to the Tenable Blog

Subscribe
Try for Free Buy Now

Try Tenable.io

FREE FOR 30 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now.

Buy Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

$2,275

Buy Now

Try for Free Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, email, community and chat support 24 hours a day, 365 days a year. Full details here.

Try for Free Buy Now

Try Tenable.io Web Application Scanning

FREE FOR 30 DAYS

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try for Free Contact Sales

Try Tenable.io Container Security

FREE FOR 30 DAYS

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Learn More about Industrial Security

Get a Demo of Tenable.sc

Please fill out the form below with your contact information and a sales representative will contact you shortly to schedule a demo. You may also include a short comment (limited to 255 characters). Please note that fields with asterisks (*) are mandatory.

Try for Free Contact Sales

Try Tenable Lumin

FREE FOR 30 DAYS

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.