Detections
Analytics
Alpine: multiple py3-twisted packages: security update to 19.10.0-r0
high Tenable Self-Hosted Container Security Plugin ID 406710
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The
attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of
responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
(CVE-2019-9512)
- Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
The attacker opens a number of streams and sends an invalid request over each stream that should solicit a
stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this
can consume excess memory, CPU, or both. (CVE-2019-9514)
- Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of
service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer
reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in
behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory,
or both. (CVE-2019-9515)
See Also
https://security.alpinelinux.org/vuln/CVE-2019-9512
Plugin Details
Severity: High
ID: 406710
Version: Revision 1.33
Type: Local
Published: 10/31/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.71
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2019-9515
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 8/9/2019