Detections
Analytics
Alpine: multiple go packages: security update to 1.12.7-r0 (deprecated)
critical Tenable Self-Hosted Container Security Plugin ID 400456
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The
attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of
responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
(CVE-2019-9512)
- Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
The attacker opens a number of streams and sends an invalid request over each stream that should solicit a
stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this
can consume excess memory, CPU, or both. (CVE-2019-9514)
- net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an
authorization bypass in some applications. This is related to a Host field with a suffix appearing in
neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can
compose a crafted javascript:// URL that results in a hostname of google.com. (CVE-2019-14809)
See Also
https://git.alpinelinux.org/aports/commit/?id=47b884dea70811fd555745e6be786774b2de0384
https://git.alpinelinux.org/aports/commit/?id=f4894bf9bd05edccdac484db35c4d6fb06a3b26c
Plugin Details
Severity: Critical
ID: 400456
Version: Revision 1.24
Type: Local
Published: 8/16/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2019-14809
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 8/14/2019
Vulnerability Publication Date: 8/9/2019