CVE-2019-9511: Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service
First published: Tue Aug 13 2019(Updated: )
A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a denial of service. The highest threat from this vulnerability is to system availability.
Credit: cret@cert.org cret@cert.org cret@cert.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/jbcs-httpd24-httpd | <0:2.4.29-41.jbcs.el6 | 0:2.4.29-41.jbcs.el6 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.39.2-1.jbcs.el6 | 0:1.39.2-1.jbcs.el6 |
| redhat/jbcs-httpd24-apr | <0:1.6.3-63.jbcs.el6 | 0:1.6.3-63.jbcs.el6 |
| redhat/jbcs-httpd24-apr-util | <0:1.6.1-48.jbcs.el6 | 0:1.6.1-48.jbcs.el6 |
| redhat/jbcs-httpd24-brotli | <0:1.0.6-7.jbcs.el6 | 0:1.0.6-7.jbcs.el6 |
| redhat/jbcs-httpd24-curl | <0:7.64.1-14.jbcs.el6 | 0:7.64.1-14.jbcs.el6 |
| redhat/jbcs-httpd24-httpd | <0:2.4.37-33.jbcs.el6 | 0:2.4.37-33.jbcs.el6 |
| redhat/jbcs-httpd24-jansson | <0:2.11-20.jbcs.el6 | 0:2.11-20.jbcs.el6 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.39.2-4.jbcs.el6 | 0:1.39.2-4.jbcs.el6 |
| redhat/jbcs-httpd24-openssl | <1:1.1.1-25.jbcs.el6 | 1:1.1.1-25.jbcs.el6 |
| redhat/jbcs-httpd24-httpd | <0:2.4.29-41.jbcs.el7 | 0:2.4.29-41.jbcs.el7 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.39.2-1.jbcs.el7 | 0:1.39.2-1.jbcs.el7 |
| redhat/jbcs-httpd24-apr | <0:1.6.3-63.jbcs.el7 | 0:1.6.3-63.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util | <0:1.6.1-48.jbcs.el7 | 0:1.6.1-48.jbcs.el7 |
| redhat/jbcs-httpd24-brotli | <0:1.0.6-7.jbcs.el7 | 0:1.0.6-7.jbcs.el7 |
| redhat/jbcs-httpd24-curl | <0:7.64.1-14.jbcs.el7 | 0:7.64.1-14.jbcs.el7 |
| redhat/jbcs-httpd24-httpd | <0:2.4.37-33.jbcs.el7 | 0:2.4.37-33.jbcs.el7 |
| redhat/jbcs-httpd24-jansson | <0:2.11-20.jbcs.el7 | 0:2.11-20.jbcs.el7 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.39.2-4.jbcs.el7 | 0:1.39.2-4.jbcs.el7 |
| redhat/jbcs-httpd24-openssl | <1:1.1.1-25.jbcs.el7 | 1:1.1.1-25.jbcs.el7 |
| redhat/kiali | <0:v1.0.6.redhat1-1.el7 | 0:v1.0.6.redhat1-1.el7 |
| redhat/servicemesh | <0:1.0.1-8.el8 | 0:1.0.1-8.el8 |
| redhat/servicemesh-cni | <0:1.0.1-8.el8 | 0:1.0.1-8.el8 |
| redhat/servicemesh-grafana | <0:6.2.2-21.el8 | 0:6.2.2-21.el8 |
| redhat/servicemesh-operator | <0:1.0.1-8.el8 | 0:1.0.1-8.el8 |
| redhat/servicemesh-prometheus | <0:2.7.2-22.el8 | 0:2.7.2-22.el8 |
| redhat/servicemesh-proxy | <0:1.0.1-7.el8 | 0:1.0.1-7.el8 |
| redhat/nghttp2 | <0:1.33.0-1.el8_0.1 | 0:1.33.0-1.el8_0.1 |
| redhat/eap7-apache-cxf | <0:3.2.10-1.redhat_00001.1.el6ea | 0:3.2.10-1.redhat_00001.1.el6ea |
| redhat/eap7-byte-buddy | <0:1.9.11-1.redhat_00002.1.el6ea | 0:1.9.11-1.redhat_00002.1.el6ea |
| redhat/eap7-glassfish-jsf | <0:2.3.5-5.SP3_redhat_00003.1.el6ea | 0:2.3.5-5.SP3_redhat_00003.1.el6ea |
| redhat/eap7-hal-console | <0:3.0.17-2.Final_redhat_00001.1.el6ea | 0:3.0.17-2.Final_redhat_00001.1.el6ea |
| redhat/eap7-hibernate | <0:5.3.13-1.Final_redhat_00001.1.el6ea | 0:5.3.13-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-ironjacamar | <0:1.4.18-1.Final_redhat_00001.1.el6ea | 0:1.4.18-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-jboss-genericjms | <0:2.0.2-1.Final_redhat_00001.1.el6ea | 0:2.0.2-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-jboss-msc | <0:1.4.11-1.Final_redhat_00001.1.el6ea | 0:1.4.11-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-jboss-remoting | <0:5.0.16-2.Final_redhat_00001.1.el6ea | 0:5.0.16-2.Final_redhat_00001.1.el6ea |
| redhat/eap7-jboss-server-migration | <0:1.3.1-6.Final_redhat_00006.1.el6ea | 0:1.3.1-6.Final_redhat_00006.1.el6ea |
| redhat/eap7-jboss-xnio-base | <0:3.7.6-2.SP1_redhat_00001.1.el6ea | 0:3.7.6-2.SP1_redhat_00001.1.el6ea |
| redhat/eap7-picketbox | <0:5.0.3-6.Final_redhat_00005.1.el6ea | 0:5.0.3-6.Final_redhat_00005.1.el6ea |
| redhat/eap7-picketlink-bindings | <0:2.5.5-20.SP12_redhat_00009.1.el6ea | 0:2.5.5-20.SP12_redhat_00009.1.el6ea |
| redhat/eap7-picketlink-federation | <0:2.5.5-20.SP12_redhat_00009.1.el6ea | 0:2.5.5-20.SP12_redhat_00009.1.el6ea |
| redhat/eap7-resteasy | <0:3.6.1-7.SP7_redhat_00001.1.el6ea | 0:3.6.1-7.SP7_redhat_00001.1.el6ea |
| redhat/eap7-undertow | <0:2.0.26-2.SP3_redhat_00001.1.el6ea | 0:2.0.26-2.SP3_redhat_00001.1.el6ea |
| redhat/eap7-wildfly | <0:7.2.5-4.GA_redhat_00002.1.el6ea | 0:7.2.5-4.GA_redhat_00002.1.el6ea |
| redhat/eap7-wildfly-elytron | <0:1.6.5-1.Final_redhat_00001.1.el6ea | 0:1.6.5-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-wildfly-elytron-tool | <0:1.4.4-1.Final_redhat_00001.1.el6ea | 0:1.4.4-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-wildfly-http-client | <0:1.0.17-1.Final_redhat_00001.1.el6ea | 0:1.0.17-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-wildfly-openssl | <0:1.0.8-1.Final_redhat_00001.1.el6ea | 0:1.0.8-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-yasson | <0:1.0.5-1.redhat_00001.1.el6ea | 0:1.0.5-1.redhat_00001.1.el6ea |
| redhat/eap7-apache-cxf | <0:3.2.10-1.redhat_00001.1.el7ea | 0:3.2.10-1.redhat_00001.1.el7ea |
| redhat/eap7-byte-buddy | <0:1.9.11-1.redhat_00002.1.el7ea | 0:1.9.11-1.redhat_00002.1.el7ea |
| redhat/eap7-glassfish-jsf | <0:2.3.5-5.SP3_redhat_00003.1.el7ea | 0:2.3.5-5.SP3_redhat_00003.1.el7ea |
| redhat/eap7-hal-console | <0:3.0.17-2.Final_redhat_00001.1.el7ea | 0:3.0.17-2.Final_redhat_00001.1.el7ea |
| redhat/eap7-hibernate | <0:5.3.13-1.Final_redhat_00001.1.el7ea | 0:5.3.13-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-ironjacamar | <0:1.4.18-1.Final_redhat_00001.1.el7ea | 0:1.4.18-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-jboss-genericjms | <0:2.0.2-1.Final_redhat_00001.1.el7ea | 0:2.0.2-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-jboss-msc | <0:1.4.11-1.Final_redhat_00001.1.el7ea | 0:1.4.11-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-jboss-remoting | <0:5.0.16-2.Final_redhat_00001.1.el7ea | 0:5.0.16-2.Final_redhat_00001.1.el7ea |
| redhat/eap7-jboss-server-migration | <0:1.3.1-6.Final_redhat_00006.1.el7ea | 0:1.3.1-6.Final_redhat_00006.1.el7ea |
| redhat/eap7-jboss-xnio-base | <0:3.7.6-2.SP1_redhat_00001.1.el7ea | 0:3.7.6-2.SP1_redhat_00001.1.el7ea |
| redhat/eap7-picketbox | <0:5.0.3-6.Final_redhat_00005.1.el7ea | 0:5.0.3-6.Final_redhat_00005.1.el7ea |
| redhat/eap7-picketlink-bindings | <0:2.5.5-20.SP12_redhat_00009.1.el7ea | 0:2.5.5-20.SP12_redhat_00009.1.el7ea |
| redhat/eap7-picketlink-federation | <0:2.5.5-20.SP12_redhat_00009.1.el7ea | 0:2.5.5-20.SP12_redhat_00009.1.el7ea |
| redhat/eap7-resteasy | <0:3.6.1-7.SP7_redhat_00001.1.el7ea | 0:3.6.1-7.SP7_redhat_00001.1.el7ea |
| redhat/eap7-undertow | <0:2.0.26-2.SP3_redhat_00001.1.el7ea | 0:2.0.26-2.SP3_redhat_00001.1.el7ea |
| redhat/eap7-wildfly | <0:7.2.5-4.GA_redhat_00002.1.el7ea | 0:7.2.5-4.GA_redhat_00002.1.el7ea |
| redhat/eap7-wildfly-elytron | <0:1.6.5-1.Final_redhat_00001.1.el7ea | 0:1.6.5-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-wildfly-elytron-tool | <0:1.4.4-1.Final_redhat_00001.1.el7ea | 0:1.4.4-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-wildfly-http-client | <0:1.0.17-1.Final_redhat_00001.1.el7ea | 0:1.0.17-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-wildfly-openssl | <0:1.0.8-1.Final_redhat_00001.1.el7ea | 0:1.0.8-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-yasson | <0:1.0.5-1.redhat_00001.1.el7ea | 0:1.0.5-1.redhat_00001.1.el7ea |
| redhat/eap7-apache-cxf | <0:3.2.10-1.redhat_00001.1.el8ea | 0:3.2.10-1.redhat_00001.1.el8ea |
| redhat/eap7-byte-buddy | <0:1.9.11-1.redhat_00002.1.el8ea | 0:1.9.11-1.redhat_00002.1.el8ea |
| redhat/eap7-glassfish-jsf | <0:2.3.5-5.SP3_redhat_00003.1.el8ea | 0:2.3.5-5.SP3_redhat_00003.1.el8ea |
| redhat/eap7-hal-console | <0:3.0.17-2.Final_redhat_00001.1.el8ea | 0:3.0.17-2.Final_redhat_00001.1.el8ea |
| redhat/eap7-hibernate | <0:5.3.13-1.Final_redhat_00001.1.el8ea | 0:5.3.13-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-ironjacamar | <0:1.4.18-1.Final_redhat_00001.1.el8ea | 0:1.4.18-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-jboss-genericjms | <0:2.0.2-1.Final_redhat_00001.1.el8ea | 0:2.0.2-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-jboss-msc | <0:1.4.11-1.Final_redhat_00001.1.el8ea | 0:1.4.11-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-jboss-remoting | <0:5.0.16-2.Final_redhat_00001.1.el8ea | 0:5.0.16-2.Final_redhat_00001.1.el8ea |
| redhat/eap7-jboss-server-migration | <0:1.3.1-6.Final_redhat_00006.1.el8ea | 0:1.3.1-6.Final_redhat_00006.1.el8ea |
| redhat/eap7-jboss-xnio-base | <0:3.7.6-2.SP1_redhat_00001.1.el8ea | 0:3.7.6-2.SP1_redhat_00001.1.el8ea |
| redhat/eap7-picketbox | <0:5.0.3-6.Final_redhat_00005.1.el8ea | 0:5.0.3-6.Final_redhat_00005.1.el8ea |
| redhat/eap7-picketlink-bindings | <0:2.5.5-20.SP12_redhat_00009.1.el8ea | 0:2.5.5-20.SP12_redhat_00009.1.el8ea |
| redhat/eap7-picketlink-federation | <0:2.5.5-20.SP12_redhat_00009.1.el8ea | 0:2.5.5-20.SP12_redhat_00009.1.el8ea |
| redhat/eap7-resteasy | <0:3.6.1-7.SP7_redhat_00001.1.el8ea | 0:3.6.1-7.SP7_redhat_00001.1.el8ea |
| redhat/eap7-undertow | <0:2.0.26-2.SP3_redhat_00001.1.el8ea | 0:2.0.26-2.SP3_redhat_00001.1.el8ea |
| redhat/eap7-wildfly | <0:7.2.5-4.GA_redhat_00002.1.el8ea | 0:7.2.5-4.GA_redhat_00002.1.el8ea |
| redhat/eap7-wildfly-elytron | <0:1.6.5-1.Final_redhat_00001.1.el8ea | 0:1.6.5-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-wildfly-elytron-tool | <0:1.4.4-1.Final_redhat_00001.1.el8ea | 0:1.4.4-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-wildfly-http-client | <0:1.0.17-1.Final_redhat_00001.1.el8ea | 0:1.0.17-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-wildfly-openssl | <0:1.0.8-1.Final_redhat_00001.1.el8ea | 0:1.0.8-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-yasson | <0:1.0.5-1.redhat_00001.1.el8ea | 0:1.0.5-1.redhat_00001.1.el8ea |
| redhat/rh-nginx110-nginx | <1:1.10.2-9.el6.1 | 1:1.10.2-9.el6.1 |
| redhat/httpd24-httpd | <0:2.4.34-8.el6.1 | 0:2.4.34-8.el6.1 |
| redhat/httpd24-nghttp2 | <0:1.7.1-7.el6.1 | 0:1.7.1-7.el6.1 |
| redhat/rh-nginx110-nginx | <1:1.10.2-9.el7.1 | 1:1.10.2-9.el7.1 |
| redhat/rh-nginx112-nginx | <1:1.12.1-3.el7.1 | 1:1.12.1-3.el7.1 |
| redhat/rh-nginx114-nginx | <1:1.14.1-1.el7.1 | 1:1.14.1-1.el7.1 |
| redhat/rh-nodejs10 | <0:3.2-3.el7 | 0:3.2-3.el7 |
| redhat/rh-nodejs10-nodejs | <0:10.16.3-3.el7 | 0:10.16.3-3.el7 |
| redhat/httpd24-httpd | <0:2.4.34-8.el7.1 | 0:2.4.34-8.el7.1 |
| redhat/httpd24-nghttp2 | <0:1.7.1-7.el7.1 | 0:1.7.1-7.el7.1 |
| redhat/rh-nodejs8 | <0:3.0-5.el7 | 0:3.0-5.el7 |
| redhat/rh-nodejs8-nodejs | <0:8.16.1-2.el7 | 0:8.16.1-2.el7 |
| redhat/Nodejs | <8.16.1 | 8.16.1 |
| redhat/Nodejs | <10.16.3 | 10.16.3 |
| redhat/Nodejs | <12.8.1 | 12.8.1 |
| redhat/nginx | <1.16.1 | 1.16.1 |
| redhat/nginx | <1.17.3 | 1.17.3 |
| debian/nghttp2 | 1.43.0-1+deb11u1 1.43.0-1+deb11u2 1.52.0-1+deb12u2 1.52.0-1+deb12u1 1.64.0-1 | |
| debian/nginx | 1.18.0-6.1+deb11u3 1.22.1-9 1.26.3-2 | |
| debian/nodejs | 12.22.12~dfsg-1~deb11u4 12.22.12~dfsg-1~deb11u5 18.19.0+dfsg-6~deb12u2 18.19.0+dfsg-6~deb12u1 20.18.2+dfsg-4 20.18.3+dfsg-1 | |
| SwiftNIO | >=1.0.0<=1.4.0 | |
| Apple iOS and macOS | >=10.12 | |
| Ubuntu | >=14.04 | |
| Apache Traffic Server | >=6.0.0<=6.2.3 | |
| Apache Traffic Server | >=7.0.0<=7.1.6 | |
| Apache Traffic Server | >=8.0.0<=8.0.3 | |
| Ubuntu | =16.04 | |
| Ubuntu | =18.04 | |
| Ubuntu | =19.04 | |
| Debian | =9.0 | |
| Debian | =10.0 | |
| Synology DiskStation Manager | =6.2 | |
| synology skynas | ||
| synology vs960hd firmware | ||
| synology vs960hd | ||
| Fedora | =29 | |
| Fedora | =30 | |
| openSUSE | =15.0 | |
| openSUSE | =15.1 | |
| redhat jboss core services | =1.0 | |
| redhat jboss enterprise application platform | =7.2.0 | |
| redhat jboss enterprise application platform | =7.3.0 | |
| redhat openshift service mesh | =1.0 | |
| redhat quay | =3.0.0 | |
| redhat software collections | =1.0 | |
| Red Hat Enterprise Linux | =8.0 | |
| Oracle GraalVM Enterprise Edition | =19.2.0 | |
| McAfee Web Gateway | >=7.7.2.0<7.7.2.24 | |
| McAfee Web Gateway | >=7.8.2.0<7.8.2.13 | |
| McAfee Web Gateway | >=8.1.0<8.2.0 | |
| F5 NGINX App Protect | >=1.9.5<1.16.1 | |
| F5 NGINX App Protect | >=1.17.0<=1.17.2 | |
| Oracle Enterprise Communications Broker | =3.1.0 | |
| Oracle Enterprise Communications Broker | =3.2.0 | |
| Node.js | >=8.0.0<=8.8.1 | |
| Node.js | >=8.9.0<8.16.1 | |
| Node.js | >=10.0.0<=10.12.0 | |
| Node.js | >=10.13.0<10.16.3 | |
| Node.js | >=12.0.0<12.8.1 | |
| All of | ||
| SwiftNIO | >=1.0.0<=1.4.0 | |
| Any of | ||
| Apple iOS and macOS | >=10.12 | |
| Ubuntu | >=14.04 | |
| Synology DiskStation Manager | =6.2 | |
| All of | ||
| synology vs960hd firmware | ||
| synology vs960hd |
Remedy
Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions: 1. Copy the Nginx configuration from the quay container to the host $ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx 2. Edit the Nginx configuration, removing http/2 support $ sed -i 's/http2 //g' /mnt/quay/nginx/nginx.conf 3. Restart Nginx with the new configuration mounted into the container, eg: $ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2019-9511 https://nvd.nist.gov/vuln/detail/CVE-2019-9511 https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md https://kb.cert.org/vuls/id/605641/ https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/ https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
- https://bugzilla.redhat.com/show_bug.cgi?id=1741860
- https://access.redhat.com/errata/RHSA-2019:2946
- https://access.redhat.com/errata/RHSA-2019:3932
- https://access.redhat.com/errata/RHSA-2019:3933
- https://access.redhat.com/errata/RHSA-2019:3041
- https://access.redhat.com/errata/RHSA-2020:0922
- https://access.redhat.com/errata/RHSA-2020:1445
- https://access.redhat.com/errata/RHSA-2019:2799
- https://access.redhat.com/errata/RHSA-2019:2925
- https://access.redhat.com/errata/RHSA-2019:2692
- https://access.redhat.com/errata/RHSA-2019:3935
- https://access.redhat.com/errata/RHSA-2019:4021
- https://access.redhat.com/errata/RHSA-2019:4018
- https://access.redhat.com/errata/RHSA-2019:4019
- https://access.redhat.com/errata/RHSA-2019:4020
- https://access.redhat.com/errata/RHSA-2020:2565
- https://access.redhat.com/errata/RHSA-2020:3192
- https://access.redhat.com/errata/RHSA-2019:2966
- https://access.redhat.com/errata/RHSA-2019:2745
- https://access.redhat.com/errata/RHSA-2019:2949
- https://access.redhat.com/errata/RHSA-2019:2746
- https://access.redhat.com/errata/RHSA-2019:2775
- https://access.redhat.com/errata/RHSA-2019:2939
- https://access.redhat.com/errata/RHSA-2019:2955
- https://access.redhat.com/errata/RHSA-2020:2067
- https://access.redhat.com/security/cve/cve-2019-9511
- https://kb.cert.org/vuls/id/605641/
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- https://usn.ubuntu.com/4099-1/
- https://www.synology.com/security/advisory/Synology_SA_19_33
- https://support.f5.com/csp/article/K02591030
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/
- https://seclists.org/bugtraq/2019/Aug/40
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/
- https://security.netapp.com/advisory/ntap-20190823-0002/
- https://security.netapp.com/advisory/ntap-20190823-0005/
- https://www.debian.org/security/2019/dsa-4505
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/
- https://seclists.org/bugtraq/2019/Sep/1
- https://www.debian.org/security/2019/dsa-4511
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html
- https://support.f5.com/csp/article/K02591030?utm_source=f5support&amp;utm_medium=RSS
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.debian.org/security/2020/dsa-4669
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://launchpad.net/bugs/cve/CVE-2019-9511
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- https://support.f5.com/csp/article/K02591030?utm_source=f5support&utm_medium=RSS
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/
- https://support.f5.com/csp/article/K02591030?utm_source=f5support&%3Butm_medium=RSS
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741861
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741948
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741947
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741950
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741982
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741981
- https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
- https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1742376
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1742375
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1744803
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1744802
- https://github.com/nodejs/node/commit/c152449012
- https://github.com/nodejs/node/commit/0ce699c7b1
- https://github.com/nghttp2/nghttp2/commit/95efb3e19d174354ca50c65d5d7227d92bcd60e1
- http://hg.nginx.org/nginx/rev/99b6733876c4
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1748606
- https://access.redhat.com/errata/RHSA-2024:5856
- https://github.com/nginx/nginx/commit/a987f81dd19210bc30b62591db331e31d3d74089
- https://github.com/nginx/nginx/commit/94c5eb142e58a86f81eb1369fa6fcb96c2f23d6b
- https://github.com/nghttp2/nghttp2/releases/tag/v1.39.2
- https://security-tracker.debian.org/tracker/CVE-2019-9511
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9511
- https://nvd.nist.gov/vuln/detail/CVE-2019-9511
- https://ubuntu.com/security/CVE-2019-9511
Parent vulnerabilities
(Appears in the following advisories)
- RHSA-2019:2946
- RHSA-2019:3932
- RHSA-2019:3933
- RHSA-2019:3041
- RHSA-2020:0922
- RHSA-2020:1445
- RHSA-2019:2799
- RHSA-2019:2925
- RHSA-2019:2692
- RHSA-2019:3935
- RHSA-2019:4021
- RHSA-2019:4018
- RHSA-2019:4019
- RHSA-2019:4020
- RHSA-2020:2565
- RHSA-2020:3192
- RHSA-2019:2966
- RHSA-2019:2745
- RHSA-2019:2949
- RHSA-2019:2746
- RHSA-2019:2775
- RHSA-2019:2939
- RHSA-2019:2955
- RHSA-2020:2067
Frequently Asked Questions
What is the severity of CVE-2019-9511?
CVE-2019-9511 has been rated as a moderate severity vulnerability due to its potential impact on system performance and resources.
How do I fix CVE-2019-9511?
To remediate CVE-2019-9511, update to the patched versions specified by Red Hat for affected packages such as jbcs-httpd24-httpd and jbcs-httpd24-nghttp2.
What types of software are affected by CVE-2019-9511?
CVE-2019-9511 affects various packages including Red Hat's JBoss Core Services, Apache HTTP Server, and Node.js among others.
Is my system vulnerable to CVE-2019-9511?
To determine if your system is vulnerable to CVE-2019-9511, verify if you are using any affected versions of the mentioned packages.
What are the potential impacts of CVE-2019-9511?
The potential impacts of CVE-2019-9511 include excessive CPU and memory consumption, leading to degraded application performance.
- collector/redhat-cve
- agent/type
- collector/launchpad-cve
- source/Launchpad
- agent/first-publish-date
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-9511
- agent/software-canonical-lookup
- collector/usn-cve
- source/Ubuntu
- agent/remedy
- agent/references
- agent/description
- agent/trending
- agent/last-modified-date
- agent/author
- agent/source
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- collector/nvd-api
- package-manager/redhat
- package-manager/debian
- vendor/apple
- canonical/swiftnio
- version/swiftnio/1.0.0
- version/swiftnio/1.4.0
- canonical/apple ios and macos
- version/apple ios and macos/10.12
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/14.04
- vendor/apache
- canonical/apache traffic server
- version/apache traffic server/6.0.0
- version/apache traffic server/6.2.3
- version/apache traffic server/7.0.0
- version/apache traffic server/7.1.6
- version/apache traffic server/8.0.0
- version/apache traffic server/8.0.3
- version/ubuntu/16.04
- version/ubuntu/18.04
- version/ubuntu/19.04
- vendor/debian
- canonical/debian
- version/debian/9.0
- version/debian/10.0
- vendor/synology
- canonical/synology diskstation manager
- version/synology diskstation manager/6.2
- canonical/synology skynas
- canonical/synology vs960hd firmware
- canonical/synology vs960hd
- vendor/fedoraproject
- canonical/fedora
- version/fedora/29
- version/fedora/30
- vendor/opensuse
- canonical/opensuse
- version/opensuse/15.0
- version/opensuse/15.1
- vendor/redhat
- canonical/redhat jboss core services
- version/redhat jboss core services/1.0
- canonical/redhat jboss enterprise application platform
- version/redhat jboss enterprise application platform/7.2.0
- version/redhat jboss enterprise application platform/7.3.0
- canonical/redhat openshift service mesh
- version/redhat openshift service mesh/1.0
- canonical/redhat quay
- version/redhat quay/3.0.0
- canonical/redhat software collections
- version/redhat software collections/1.0
- canonical/red hat enterprise linux
- version/red hat enterprise linux/8.0
- vendor/oracle
- canonical/oracle graalvm enterprise edition
- version/oracle graalvm enterprise edition/19.2.0
- vendor/mcafee
- canonical/mcafee web gateway
- version/mcafee web gateway/7.7.2.0
- version/mcafee web gateway/7.8.2.0
- version/mcafee web gateway/8.1.0
- vendor/f5
- canonical/f5 nginx app protect
- version/f5 nginx app protect/1.9.5
- version/f5 nginx app protect/1.17.0
- version/f5 nginx app protect/1.17.2
- canonical/oracle enterprise communications broker
- version/oracle enterprise communications broker/3.1.0
- version/oracle enterprise communications broker/3.2.0
- vendor/nodejs
- canonical/node.js
- version/node.js/8.0.0
- version/node.js/8.8.1
- version/node.js/8.9.0
- version/node.js/10.0.0
- version/node.js/10.12.0
- version/node.js/10.13.0
- version/node.js/12.0.0