CVE-2019-9513: Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service
First published: Thu Aug 01 2019(Updated: )
A flaw was found in HTTP/2. An attacker, using PRIORITY frames to flood the system, could cause excessive CPU usage and starvation of other clients. The largest threat from this vulnerability is to system availability.
Credit: cret@cert.org cret@cert.org cret@cert.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/jbcs-httpd24-httpd | <0:2.4.29-41.jbcs.el6 | 0:2.4.29-41.jbcs.el6 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.39.2-1.jbcs.el6 | 0:1.39.2-1.jbcs.el6 |
| redhat/jbcs-httpd24-apr | <0:1.6.3-63.jbcs.el6 | 0:1.6.3-63.jbcs.el6 |
| redhat/jbcs-httpd24-apr-util | <0:1.6.1-48.jbcs.el6 | 0:1.6.1-48.jbcs.el6 |
| redhat/jbcs-httpd24-brotli | <0:1.0.6-7.jbcs.el6 | 0:1.0.6-7.jbcs.el6 |
| redhat/jbcs-httpd24-curl | <0:7.64.1-14.jbcs.el6 | 0:7.64.1-14.jbcs.el6 |
| redhat/jbcs-httpd24-httpd | <0:2.4.37-33.jbcs.el6 | 0:2.4.37-33.jbcs.el6 |
| redhat/jbcs-httpd24-jansson | <0:2.11-20.jbcs.el6 | 0:2.11-20.jbcs.el6 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.39.2-4.jbcs.el6 | 0:1.39.2-4.jbcs.el6 |
| redhat/jbcs-httpd24-openssl | <1:1.1.1-25.jbcs.el6 | 1:1.1.1-25.jbcs.el6 |
| redhat/jbcs-httpd24-httpd | <0:2.4.29-41.jbcs.el7 | 0:2.4.29-41.jbcs.el7 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.39.2-1.jbcs.el7 | 0:1.39.2-1.jbcs.el7 |
| redhat/jbcs-httpd24-apr | <0:1.6.3-63.jbcs.el7 | 0:1.6.3-63.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util | <0:1.6.1-48.jbcs.el7 | 0:1.6.1-48.jbcs.el7 |
| redhat/jbcs-httpd24-brotli | <0:1.0.6-7.jbcs.el7 | 0:1.0.6-7.jbcs.el7 |
| redhat/jbcs-httpd24-curl | <0:7.64.1-14.jbcs.el7 | 0:7.64.1-14.jbcs.el7 |
| redhat/jbcs-httpd24-httpd | <0:2.4.37-33.jbcs.el7 | 0:2.4.37-33.jbcs.el7 |
| redhat/jbcs-httpd24-jansson | <0:2.11-20.jbcs.el7 | 0:2.11-20.jbcs.el7 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.39.2-4.jbcs.el7 | 0:1.39.2-4.jbcs.el7 |
| redhat/jbcs-httpd24-openssl | <1:1.1.1-25.jbcs.el7 | 1:1.1.1-25.jbcs.el7 |
| redhat/kiali | <0:v1.0.6.redhat1-1.el7 | 0:v1.0.6.redhat1-1.el7 |
| redhat/servicemesh | <0:1.0.1-8.el8 | 0:1.0.1-8.el8 |
| redhat/servicemesh-cni | <0:1.0.1-8.el8 | 0:1.0.1-8.el8 |
| redhat/servicemesh-grafana | <0:6.2.2-21.el8 | 0:6.2.2-21.el8 |
| redhat/servicemesh-operator | <0:1.0.1-8.el8 | 0:1.0.1-8.el8 |
| redhat/servicemesh-prometheus | <0:2.7.2-22.el8 | 0:2.7.2-22.el8 |
| redhat/servicemesh-proxy | <0:1.0.1-7.el8 | 0:1.0.1-7.el8 |
| redhat/nghttp2 | <0:1.33.0-1.el8_0.1 | 0:1.33.0-1.el8_0.1 |
| redhat/rh-nginx110-nginx | <1:1.10.2-9.el6.1 | 1:1.10.2-9.el6.1 |
| redhat/httpd24-httpd | <0:2.4.34-8.el6.1 | 0:2.4.34-8.el6.1 |
| redhat/httpd24-nghttp2 | <0:1.7.1-7.el6.1 | 0:1.7.1-7.el6.1 |
| redhat/rh-nginx110-nginx | <1:1.10.2-9.el7.1 | 1:1.10.2-9.el7.1 |
| redhat/rh-nginx112-nginx | <1:1.12.1-3.el7.1 | 1:1.12.1-3.el7.1 |
| redhat/rh-nginx114-nginx | <1:1.14.1-1.el7.1 | 1:1.14.1-1.el7.1 |
| redhat/rh-nodejs10 | <0:3.2-3.el7 | 0:3.2-3.el7 |
| redhat/rh-nodejs10-nodejs | <0:10.16.3-3.el7 | 0:10.16.3-3.el7 |
| redhat/httpd24-httpd | <0:2.4.34-8.el7.1 | 0:2.4.34-8.el7.1 |
| redhat/httpd24-nghttp2 | <0:1.7.1-7.el7.1 | 0:1.7.1-7.el7.1 |
| redhat/rh-nodejs8 | <0:3.0-5.el7 | 0:3.0-5.el7 |
| redhat/rh-nodejs8-nodejs | <0:8.16.1-2.el7 | 0:8.16.1-2.el7 |
| redhat/envoy | <1.11.1 | 1.11.1 |
| redhat/Nodejs | <8.16.1 | 8.16.1 |
| redhat/Nodejs | <10.16.3 | 10.16.3 |
| redhat/Nodejs | <12.8.1 | 12.8.1 |
| redhat/nginx | <1.16.1 | 1.16.1 |
| redhat/nginx | <1.17.3 | 1.17.3 |
| redhat/nghttp2 | <1.39.2 | 1.39.2 |
| debian/nghttp2 | 1.43.0-1+deb11u1 1.43.0-1+deb11u2 1.52.0-1+deb12u2 1.52.0-1+deb12u1 1.64.0-1 | |
| debian/nginx | 1.18.0-6.1+deb11u3 1.22.1-9 1.26.3-2 | |
| debian/nodejs | 12.22.12~dfsg-1~deb11u4 12.22.12~dfsg-1~deb11u5 18.19.0+dfsg-6~deb12u2 18.19.0+dfsg-6~deb12u1 20.18.2+dfsg-4 20.18.3+dfsg-1 | |
| All of | ||
| SwiftNIO | >=1.0.0<=1.4.0 | |
| Any of | ||
| Apple iOS and macOS | >=10.12 | |
| Ubuntu | >=14.04 | |
| Apache Traffic Server | >=6.0.0<=6.2.3 | |
| Apache Traffic Server | >=7.0.0<=7.1.6 | |
| Apache Traffic Server | >=8.0.0<=8.0.3 | |
| Ubuntu | =16.04 | |
| Ubuntu | =18.04 | |
| Ubuntu | =19.04 | |
| Debian | =9.0 | |
| Debian | =10.0 | |
| Fedora | =30 | |
| synology skynas | ||
| Synology DiskStation Manager | =6.2 | |
| All of | ||
| synology vs960hd firmware | ||
| synology vs960hd | ||
| Fedora | =29 | |
| openSUSE | =15.0 | |
| openSUSE | =15.1 | |
| redhat jboss core services | =1.0 | |
| redhat jboss enterprise application platform | =7.2.0 | |
| redhat jboss enterprise application platform | =7.3.0 | |
| redhat openshift service mesh | =1.0 | |
| redhat quay | =3.0.0 | |
| redhat software collections | =1.0 | |
| Red Hat Enterprise Linux | =8.0 | |
| Oracle GraalVM Enterprise Edition | =19.2.0 | |
| McAfee Web Gateway | >=7.7.2.0<7.7.2.24 | |
| McAfee Web Gateway | >=7.8.2.0<7.8.2.13 | |
| McAfee Web Gateway | >=8.1.0<8.2.0 | |
| F5 NGINX App Protect | >=1.9.5<1.16.1 | |
| F5 NGINX App Protect | >=1.17.0<=1.17.2 | |
| Oracle Enterprise Communications Broker | =3.1.0 | |
| Oracle Enterprise Communications Broker | =3.2.0 | |
| Node.js | >=8.0.0<=8.8.1 | |
| Node.js | >=8.9.0<8.16.1 | |
| Node.js | >=10.0.0<=10.12.0 | |
| Node.js | >=10.13.0<10.16.3 | |
| Node.js | >=12.0.0<12.8.1 | |
| SwiftNIO | >=1.0.0<=1.4.0 | |
| Apple iOS and macOS | >=10.12 | |
| Ubuntu | >=14.04 | |
| Synology DiskStation Manager | =6.2 | |
| synology vs960hd firmware | ||
| synology vs960hd |
Remedy
Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions: 1. Copy the Nginx configuration from the quay container to the host $ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx 2. Edit the Nginx configuration, removing http/2 support $ sed -i 's/http2 //g' /mnt/quay/nginx/nginx.conf 3. Restart Nginx with the new configuration mounted into the container, eg: $ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2019-9513 https://nvd.nist.gov/vuln/detail/CVE-2019-9513 https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/ https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/ https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
- https://bugzilla.redhat.com/show_bug.cgi?id=1735741
- https://access.redhat.com/errata/RHSA-2019:2946
- https://access.redhat.com/errata/RHSA-2019:3932
- https://access.redhat.com/errata/RHSA-2019:3933
- https://access.redhat.com/errata/RHSA-2019:3041
- https://access.redhat.com/errata/RHSA-2019:2799
- https://access.redhat.com/errata/RHSA-2019:2925
- https://access.redhat.com/errata/RHSA-2019:2692
- https://access.redhat.com/errata/RHSA-2019:3935
- https://access.redhat.com/errata/RHSA-2020:0983
- https://access.redhat.com/errata/RHSA-2019:2966
- https://access.redhat.com/errata/RHSA-2019:2745
- https://access.redhat.com/errata/RHSA-2019:2949
- https://access.redhat.com/errata/RHSA-2019:2746
- https://access.redhat.com/errata/RHSA-2019:2775
- https://access.redhat.com/errata/RHSA-2019:2939
- https://access.redhat.com/errata/RHSA-2019:2955
- https://access.redhat.com/security/cve/CVE-2019-9513
- https://kb.cert.org/vuls/id/605641/
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- https://usn.ubuntu.com/4099-1/
- https://www.synology.com/security/advisory/Synology_SA_19_33
- https://support.f5.com/csp/article/K02591030
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/
- https://seclists.org/bugtraq/2019/Aug/40
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/
- https://security.netapp.com/advisory/ntap-20190823-0002/
- https://security.netapp.com/advisory/ntap-20190823-0005/
- https://www.debian.org/security/2019/dsa-4505
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/
- https://seclists.org/bugtraq/2019/Sep/1
- https://www.debian.org/security/2019/dsa-4511
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html
- https://support.f5.com/csp/article/K02591030?utm_source=f5support&amp;utm_medium=RSS
- https://www.debian.org/security/2020/dsa-4669
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://launchpad.net/bugs/cve/CVE-2019-9513
- https://istio.io/blog/2019/announcing-1.2.4/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741965
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741971
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741967
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1742011
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1742296
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1742294
- http://hg.nginx.org/nginx/rev/45415228990b
- https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
- https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
- https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/
- https://github.com/nghttp2/nghttp2/commit/95efb3e19d174354ca50c65d5d7227d92bcd60e1
- https://github.com/nghttp2/nghttp2/commit/0a6ce87c22c69438ecbffe52a2859c3a32f1620f
- https://github.com/nghttp2/nghttp2/commit/319d5ab1c6d916b6b8a0d85b2ae3f01b3ad04f2c
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1735741#c16
- https://src.fedoraproject.org/rpms/nghttp2/blob/epel7/f/nghttp2-1.31.1-CVE-2019-9511-and-CVE-2019-9513.patch
- https://access.redhat.com/security/cve/CVE-2019-9511
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1735741#c18
- https://src.fedoraproject.org/rpms/nghttp2/blob/epel7/f/nghttp2-1.31.1-CVE
- https://github.com/nodejs/node/commit/74507fae34
- https://github.com/nodejs/node/commit/a397c881ec
- https://github.com/nodejs/node/commit/fedfa12a33
- https://github.com/nodejs/node/commit/ab0f2ace36
- https://github.com/nodejs/node/commit/0acbe05ee2
- https://github.com/nodejs/node/commit/7f11465572
- https://github.com/nodejs/node/commit/2eb914ff5f
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1735741#c20
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1748602
- https://access.redhat.com/security/cve/cve-2019-9513
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- https://support.f5.com/csp/article/K02591030?utm_source=f5support&utm_medium=RSS
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/
- https://support.f5.com/csp/article/K02591030?utm_source=f5support&%3Butm_medium=RSS
- https://github.com/nginx/nginx/commit/5ae726912654da10a9a81b2c8436829f3e94f69f
- https://github.com/nginx/nginx/commit/39bb3b9d4a33bd03c8ae0134dedc8a7700ae7b2b
- https://github.com/nghttp2/nghttp2/releases/tag/v1.39.2
- https://security-tracker.debian.org/tracker/CVE-2019-9513
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9513
- https://nvd.nist.gov/vuln/detail/CVE-2019-9513
- https://ubuntu.com/security/CVE-2019-9513
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the severity of CVE-2019-9513?
The severity of CVE-2019-9513 is critical due to its potential impact on system availability and resource exhaustion.
How do I fix CVE-2019-9513?
To fix CVE-2019-9513, you should upgrade to the latest versions of the affected software packages as specified in the security advisories.
What are the impacted products associated with CVE-2019-9513?
Products affected by CVE-2019-9513 include various versions of Apache HTTP Server, nghttp2, and several other software packages related to HTTP/2 implementation.
Who is affected by CVE-2019-9513?
Any systems utilizing affected versions of HTTP/2 implementations, especially in web server environments, are vulnerable to CVE-2019-9513.
Is there a workaround for CVE-2019-9513?
Currently, the recommended action is to apply the relevant patches, as there are no known effective workarounds for CVE-2019-9513.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-9513
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/title
- collector/usn-cve
- source/Ubuntu
- agent/remedy
- agent/references
- agent/description
- agent/trending
- agent/last-modified-date
- agent/author
- agent/source
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/nvd-api
- package-manager/redhat
- package-manager/debian
- vendor/apple
- canonical/swiftnio
- version/swiftnio/1.0.0
- version/swiftnio/1.4.0
- canonical/apple ios and macos
- version/apple ios and macos/10.12
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/14.04
- vendor/apache
- canonical/apache traffic server
- version/apache traffic server/6.0.0
- version/apache traffic server/6.2.3
- version/apache traffic server/7.0.0
- version/apache traffic server/7.1.6
- version/apache traffic server/8.0.0
- version/apache traffic server/8.0.3
- version/ubuntu/16.04
- version/ubuntu/18.04
- version/ubuntu/19.04
- vendor/debian
- canonical/debian
- version/debian/9.0
- version/debian/10.0
- vendor/fedoraproject
- canonical/fedora
- version/fedora/30
- vendor/synology
- canonical/synology skynas
- canonical/synology diskstation manager
- version/synology diskstation manager/6.2
- canonical/synology vs960hd firmware
- canonical/synology vs960hd
- version/fedora/29
- vendor/opensuse
- canonical/opensuse
- version/opensuse/15.0
- version/opensuse/15.1
- vendor/redhat
- canonical/redhat jboss core services
- version/redhat jboss core services/1.0
- canonical/redhat jboss enterprise application platform
- version/redhat jboss enterprise application platform/7.2.0
- version/redhat jboss enterprise application platform/7.3.0
- canonical/redhat openshift service mesh
- version/redhat openshift service mesh/1.0
- canonical/redhat quay
- version/redhat quay/3.0.0
- canonical/redhat software collections
- version/redhat software collections/1.0
- canonical/red hat enterprise linux
- version/red hat enterprise linux/8.0
- vendor/oracle
- canonical/oracle graalvm enterprise edition
- version/oracle graalvm enterprise edition/19.2.0
- vendor/mcafee
- canonical/mcafee web gateway
- version/mcafee web gateway/7.7.2.0
- version/mcafee web gateway/7.8.2.0
- version/mcafee web gateway/8.1.0
- vendor/f5
- canonical/f5 nginx app protect
- version/f5 nginx app protect/1.9.5
- version/f5 nginx app protect/1.17.0
- version/f5 nginx app protect/1.17.2
- canonical/oracle enterprise communications broker
- version/oracle enterprise communications broker/3.1.0
- version/oracle enterprise communications broker/3.2.0
- vendor/nodejs
- canonical/node.js
- version/node.js/8.0.0
- version/node.js/8.8.1
- version/node.js/8.9.0
- version/node.js/10.0.0
- version/node.js/10.12.0
- version/node.js/10.13.0
- version/node.js/12.0.0