CVE-2019-9515

high

Description

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

References

https://kb.cert.org/vuls/id/605641/

https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

https://lists.apache.org/thread.html/[email protected]%3Cannounce.trafficserver.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cusers.trafficserver.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.trafficserver.apache.org%3E

https://seclists.org/bugtraq/2019/Aug/24

http://seclists.org/fulldisclosure/2019/Aug/16

https://www.synology.com/security/advisory/Synology_SA_19_33

https://support.f5.com/csp/article/K50233772

https://security.netapp.com/advisory/ntap-20190823-0005/

https://lists.fedoraproject.org/archives/list/[email protected]/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/

https://lists.fedoraproject.org/archives/list/[email protected]/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/

https://seclists.org/bugtraq/2019/Aug/43

https://www.debian.org/security/2019/dsa-4508

https://www.debian.org/security/2019/dsa-4520

https://seclists.org/bugtraq/2019/Sep/18

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html

https://kc.mcafee.com/corporate/index?page=content&id=SB10296

https://access.redhat.com/errata/RHSA-2019:2766

https://access.redhat.com/errata/RHSA-2019:2796

https://access.redhat.com/errata/RHSA-2019:2861

https://access.redhat.com/errata/RHSA-2019:2925

https://access.redhat.com/errata/RHSA-2019:2939

https://access.redhat.com/errata/RHSA-2019:2955

https://support.f5.com/csp/article/K50233772?utm_source=f5support&utm_medium=RSS

https://access.redhat.com/errata/RHSA-2019:3892

https://access.redhat.com/errata/RHSA-2019:4018

https://access.redhat.com/errata/RHSA-2019:4019

https://access.redhat.com/errata/RHSA-2019:4021

https://access.redhat.com/errata/RHSA-2019:4020

https://access.redhat.com/errata/RHSA-2019:4041

https://access.redhat.com/errata/RHSA-2019:4040

https://access.redhat.com/errata/RHSA-2019:4042

https://access.redhat.com/errata/RHSA-2019:4045

https://access.redhat.com/errata/RHSA-2019:4352

https://access.redhat.com/errata/RHSA-2020:0727

https://usn.ubuntu.com/4308-1/

Details

Source: MITRE

Published: 2019-08-13

Updated: 2022-08-12

Type: CWE-770

Risk Information

CVSS v2

Base Score: 7.8

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Impact Score: 6.9

Exploitability Score: 10

Severity: HIGH

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact Score: 3.6

Exploitability Score: 3.9

Severity: HIGH