CVE-2019-17657: Slow HTTP DoS Attacks Mitigation
First published: Mon Feb 03 2020(Updated: )
An Uncontrolled Resource Consumption vulnerability in Fortinet FortiSwitch below 3.6.11, 6.0.6 and 6.2.2, FortiAnalyzer below 6.2.3, FortiManager below 6.2.3 and FortiAP-S/W2 below 6.2.2 may allow an attacker to cause admin webUI denial of service (DoS) via handling special crafted HTTP requests/responses in pieces slowly, as demonstrated by Slow HTTP DoS Attacks.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiAnalyzer | <6.2.3 | |
| Fortinet Fortiap-s | <6.2.2 | |
| Fortinet FortiAP-W2 | <6.2.2 | |
| Fortinet FortiManager | <6.2.3 | |
| Fortinet FortiSwitch | <3.6.11 | |
| Fortinet FortiSwitch | >=6.0.0<6.0.6 | |
| Fortinet FortiSwitch | >=6.2.0<6.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-17657?
CVE-2019-17657 is an Uncontrolled Resource Consumption vulnerability in Fortinet FortiSwitch below 3.6.11, 6.0.6, and 6.2.2, FortiAnalyzer below 6.2.3, FortiManager below 6.2.3, and FortiAP-S/W2 below 6.2.2.
What is the severity of CVE-2019-17657?
The severity of CVE-2019-17657 is high with a CVSS score of 7.5.
How does CVE-2019-17657 affect Fortinet FortiSwitch?
CVE-2019-17657 may allow an attacker to cause admin webUI denial of service (DoS) by handling specially crafted HTTP requests.
Which software versions are affected by CVE-2019-17657?
Fortinet FortiSwitch versions below 3.6.11, 6.0.6, and 6.2.2, FortiAnalyzer versions below 6.2.3, FortiManager versions below 6.2.3, and FortiAP-S/W2 versions below 6.2.2 are affected by CVE-2019-17657.
How can I fix CVE-2019-17657?
To fix CVE-2019-17657, it is recommended to update Fortinet FortiSwitch to version 3.6.11, 6.0.6, or 6.2.2, FortiAnalyzer to version 6.2.3, FortiManager to version 6.2.3, and FortiAP-S/W2 to version 6.2.2 or higher.
- agent/type
- agent/author
- agent/weakness
- collector/fortiguard-psirt-latest
- source/FortiGuard
- alias/CVE-2019-17657
- collector/fortiguard-psirt
- alias/CVE-2007-6750
- agent/title
- agent/references
- agent/severity
- agent/first-publish-date
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- vendor/fortinet
- canonical/fortinet fortianalyzer
- canonical/fortinet fortiap-s
- canonical/fortinet fortiap-w2
- canonical/fortinet fortimanager
- canonical/fortinet fortiswitch
- version/fortinet fortiswitch/6.0.0
- version/fortinet fortiswitch/6.2.0