Detections
Analytics
Alpine: multiple h2o packages: security update to 2.2.5-r4 (deprecated)
high Tenable Cloud Security Plugin ID 400514
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The
attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of
responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
(CVE-2019-9512)
- Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
The attacker opens a number of streams and sends an invalid request over each stream that should solicit a
stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this
can consume excess memory, CPU, or both. (CVE-2019-9514)
- Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of
service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer
reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in
behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory,
or both. (CVE-2019-9515)
See Also
https://git.alpinelinux.org/aports/commit/?id=1e6f9b4d3f2d989dbba7b17640b425da9f8b86a0
https://git.alpinelinux.org/aports/commit/?id=ef0eda2afa081266395734f15b98788338aeb797
Plugin Details
Severity: High
ID: 400514
Version: Revision 1.30
Type: Local
Published: 8/16/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.71
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2019-9515
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 8/16/2019
Vulnerability Publication Date: 8/9/2019