CVE-2019-9514: Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
First published: Thu Aug 01 2019(Updated: )
A flaw was found in HTTP/2. Using HEADER frames with invalid HTTP headers and queuing of response RST_STREAM frames, an attacker could cause a flood resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability.
Credit: cret@cert.org cret@cert.org cret@cert.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/go-toolset | <1.11-0:1.11.13-1.el7 | 1.11-0:1.11.13-1.el7 |
| redhat/go-toolset | <1.11-golang-0:1.11.13-2.el7 | 1.11-golang-0:1.11.13-2.el7 |
| redhat/containernetworking-plugins | <0:0.8.1-4.el7_7 | 0:0.8.1-4.el7_7 |
| redhat/eap7-apache-cxf | <0:3.2.10-1.redhat_00001.1.el6ea | 0:3.2.10-1.redhat_00001.1.el6ea |
| redhat/eap7-byte-buddy | <0:1.9.11-1.redhat_00002.1.el6ea | 0:1.9.11-1.redhat_00002.1.el6ea |
| redhat/eap7-glassfish-jsf | <0:2.3.5-5.SP3_redhat_00003.1.el6ea | 0:2.3.5-5.SP3_redhat_00003.1.el6ea |
| redhat/eap7-hal-console | <0:3.0.17-2.Final_redhat_00001.1.el6ea | 0:3.0.17-2.Final_redhat_00001.1.el6ea |
| redhat/eap7-hibernate | <0:5.3.13-1.Final_redhat_00001.1.el6ea | 0:5.3.13-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-ironjacamar | <0:1.4.18-1.Final_redhat_00001.1.el6ea | 0:1.4.18-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-jboss-genericjms | <0:2.0.2-1.Final_redhat_00001.1.el6ea | 0:2.0.2-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-jboss-msc | <0:1.4.11-1.Final_redhat_00001.1.el6ea | 0:1.4.11-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-jboss-remoting | <0:5.0.16-2.Final_redhat_00001.1.el6ea | 0:5.0.16-2.Final_redhat_00001.1.el6ea |
| redhat/eap7-jboss-server-migration | <0:1.3.1-6.Final_redhat_00006.1.el6ea | 0:1.3.1-6.Final_redhat_00006.1.el6ea |
| redhat/eap7-jboss-xnio-base | <0:3.7.6-2.SP1_redhat_00001.1.el6ea | 0:3.7.6-2.SP1_redhat_00001.1.el6ea |
| redhat/eap7-picketbox | <0:5.0.3-6.Final_redhat_00005.1.el6ea | 0:5.0.3-6.Final_redhat_00005.1.el6ea |
| redhat/eap7-picketlink-bindings | <0:2.5.5-20.SP12_redhat_00009.1.el6ea | 0:2.5.5-20.SP12_redhat_00009.1.el6ea |
| redhat/eap7-picketlink-federation | <0:2.5.5-20.SP12_redhat_00009.1.el6ea | 0:2.5.5-20.SP12_redhat_00009.1.el6ea |
| redhat/eap7-resteasy | <0:3.6.1-7.SP7_redhat_00001.1.el6ea | 0:3.6.1-7.SP7_redhat_00001.1.el6ea |
| redhat/eap7-undertow | <0:2.0.26-2.SP3_redhat_00001.1.el6ea | 0:2.0.26-2.SP3_redhat_00001.1.el6ea |
| redhat/eap7-wildfly | <0:7.2.5-4.GA_redhat_00002.1.el6ea | 0:7.2.5-4.GA_redhat_00002.1.el6ea |
| redhat/eap7-wildfly-elytron | <0:1.6.5-1.Final_redhat_00001.1.el6ea | 0:1.6.5-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-wildfly-elytron-tool | <0:1.4.4-1.Final_redhat_00001.1.el6ea | 0:1.4.4-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-wildfly-http-client | <0:1.0.17-1.Final_redhat_00001.1.el6ea | 0:1.0.17-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-wildfly-openssl | <0:1.0.8-1.Final_redhat_00001.1.el6ea | 0:1.0.8-1.Final_redhat_00001.1.el6ea |
| redhat/eap7-yasson | <0:1.0.5-1.redhat_00001.1.el6ea | 0:1.0.5-1.redhat_00001.1.el6ea |
| redhat/eap7-apache-cxf | <0:3.2.10-1.redhat_00001.1.el7ea | 0:3.2.10-1.redhat_00001.1.el7ea |
| redhat/eap7-byte-buddy | <0:1.9.11-1.redhat_00002.1.el7ea | 0:1.9.11-1.redhat_00002.1.el7ea |
| redhat/eap7-glassfish-jsf | <0:2.3.5-5.SP3_redhat_00003.1.el7ea | 0:2.3.5-5.SP3_redhat_00003.1.el7ea |
| redhat/eap7-hal-console | <0:3.0.17-2.Final_redhat_00001.1.el7ea | 0:3.0.17-2.Final_redhat_00001.1.el7ea |
| redhat/eap7-hibernate | <0:5.3.13-1.Final_redhat_00001.1.el7ea | 0:5.3.13-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-ironjacamar | <0:1.4.18-1.Final_redhat_00001.1.el7ea | 0:1.4.18-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-jboss-genericjms | <0:2.0.2-1.Final_redhat_00001.1.el7ea | 0:2.0.2-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-jboss-msc | <0:1.4.11-1.Final_redhat_00001.1.el7ea | 0:1.4.11-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-jboss-remoting | <0:5.0.16-2.Final_redhat_00001.1.el7ea | 0:5.0.16-2.Final_redhat_00001.1.el7ea |
| redhat/eap7-jboss-server-migration | <0:1.3.1-6.Final_redhat_00006.1.el7ea | 0:1.3.1-6.Final_redhat_00006.1.el7ea |
| redhat/eap7-jboss-xnio-base | <0:3.7.6-2.SP1_redhat_00001.1.el7ea | 0:3.7.6-2.SP1_redhat_00001.1.el7ea |
| redhat/eap7-picketbox | <0:5.0.3-6.Final_redhat_00005.1.el7ea | 0:5.0.3-6.Final_redhat_00005.1.el7ea |
| redhat/eap7-picketlink-bindings | <0:2.5.5-20.SP12_redhat_00009.1.el7ea | 0:2.5.5-20.SP12_redhat_00009.1.el7ea |
| redhat/eap7-picketlink-federation | <0:2.5.5-20.SP12_redhat_00009.1.el7ea | 0:2.5.5-20.SP12_redhat_00009.1.el7ea |
| redhat/eap7-resteasy | <0:3.6.1-7.SP7_redhat_00001.1.el7ea | 0:3.6.1-7.SP7_redhat_00001.1.el7ea |
| redhat/eap7-undertow | <0:2.0.26-2.SP3_redhat_00001.1.el7ea | 0:2.0.26-2.SP3_redhat_00001.1.el7ea |
| redhat/eap7-wildfly | <0:7.2.5-4.GA_redhat_00002.1.el7ea | 0:7.2.5-4.GA_redhat_00002.1.el7ea |
| redhat/eap7-wildfly-elytron | <0:1.6.5-1.Final_redhat_00001.1.el7ea | 0:1.6.5-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-wildfly-elytron-tool | <0:1.4.4-1.Final_redhat_00001.1.el7ea | 0:1.4.4-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-wildfly-http-client | <0:1.0.17-1.Final_redhat_00001.1.el7ea | 0:1.0.17-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-wildfly-openssl | <0:1.0.8-1.Final_redhat_00001.1.el7ea | 0:1.0.8-1.Final_redhat_00001.1.el7ea |
| redhat/eap7-yasson | <0:1.0.5-1.redhat_00001.1.el7ea | 0:1.0.5-1.redhat_00001.1.el7ea |
| redhat/eap7-apache-cxf | <0:3.2.10-1.redhat_00001.1.el8ea | 0:3.2.10-1.redhat_00001.1.el8ea |
| redhat/eap7-byte-buddy | <0:1.9.11-1.redhat_00002.1.el8ea | 0:1.9.11-1.redhat_00002.1.el8ea |
| redhat/eap7-glassfish-jsf | <0:2.3.5-5.SP3_redhat_00003.1.el8ea | 0:2.3.5-5.SP3_redhat_00003.1.el8ea |
| redhat/eap7-hal-console | <0:3.0.17-2.Final_redhat_00001.1.el8ea | 0:3.0.17-2.Final_redhat_00001.1.el8ea |
| redhat/eap7-hibernate | <0:5.3.13-1.Final_redhat_00001.1.el8ea | 0:5.3.13-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-ironjacamar | <0:1.4.18-1.Final_redhat_00001.1.el8ea | 0:1.4.18-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-jboss-genericjms | <0:2.0.2-1.Final_redhat_00001.1.el8ea | 0:2.0.2-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-jboss-msc | <0:1.4.11-1.Final_redhat_00001.1.el8ea | 0:1.4.11-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-jboss-remoting | <0:5.0.16-2.Final_redhat_00001.1.el8ea | 0:5.0.16-2.Final_redhat_00001.1.el8ea |
| redhat/eap7-jboss-server-migration | <0:1.3.1-6.Final_redhat_00006.1.el8ea | 0:1.3.1-6.Final_redhat_00006.1.el8ea |
| redhat/eap7-jboss-xnio-base | <0:3.7.6-2.SP1_redhat_00001.1.el8ea | 0:3.7.6-2.SP1_redhat_00001.1.el8ea |
| redhat/eap7-picketbox | <0:5.0.3-6.Final_redhat_00005.1.el8ea | 0:5.0.3-6.Final_redhat_00005.1.el8ea |
| redhat/eap7-picketlink-bindings | <0:2.5.5-20.SP12_redhat_00009.1.el8ea | 0:2.5.5-20.SP12_redhat_00009.1.el8ea |
| redhat/eap7-picketlink-federation | <0:2.5.5-20.SP12_redhat_00009.1.el8ea | 0:2.5.5-20.SP12_redhat_00009.1.el8ea |
| redhat/eap7-resteasy | <0:3.6.1-7.SP7_redhat_00001.1.el8ea | 0:3.6.1-7.SP7_redhat_00001.1.el8ea |
| redhat/eap7-undertow | <0:2.0.26-2.SP3_redhat_00001.1.el8ea | 0:2.0.26-2.SP3_redhat_00001.1.el8ea |
| redhat/eap7-wildfly | <0:7.2.5-4.GA_redhat_00002.1.el8ea | 0:7.2.5-4.GA_redhat_00002.1.el8ea |
| redhat/eap7-wildfly-elytron | <0:1.6.5-1.Final_redhat_00001.1.el8ea | 0:1.6.5-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-wildfly-elytron-tool | <0:1.4.4-1.Final_redhat_00001.1.el8ea | 0:1.4.4-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-wildfly-http-client | <0:1.0.17-1.Final_redhat_00001.1.el8ea | 0:1.0.17-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-wildfly-openssl | <0:1.0.8-1.Final_redhat_00001.1.el8ea | 0:1.0.8-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-yasson | <0:1.0.5-1.redhat_00001.1.el8ea | 0:1.0.5-1.redhat_00001.1.el8ea |
| redhat/atomic-openshift | <0:3.10.170-1.git.0.8e592d6.el7 | 0:3.10.170-1.git.0.8e592d6.el7 |
| redhat/apb | <0:1.9.8-1.el7 | 0:1.9.8-1.el7 |
| redhat/atomic-openshift | <0:3.11.153-1.git.0.aaf3f71.el7 | 0:3.11.153-1.git.0.aaf3f71.el7 |
| redhat/cri-tools | <0:1.11.1-2.rhaos3.11.gitedabfb5.el7 | 0:1.11.1-2.rhaos3.11.gitedabfb5.el7 |
| redhat/openshift-monitor-project-lifecycle | <0:3.11.51-2.git.59.7b59e29.el7 | 0:3.11.51-2.git.59.7b59e29.el7 |
| redhat/cri-o | <0:1.11.16-0.2.dev.rhaos3.11.git3f89eba.el7 | 0:1.11.16-0.2.dev.rhaos3.11.git3f89eba.el7 |
| redhat/atomic-enterprise-service-catalog | <1:3.11.154-1.git.1.fa68ced.el7 | 1:3.11.154-1.git.1.fa68ced.el7 |
| redhat/atomic-openshift-cluster-autoscaler | <0:3.11.154-1.git.1.532da7a.el7 | 0:3.11.154-1.git.1.532da7a.el7 |
| redhat/atomic-openshift-descheduler | <0:3.11.154-1.git.1.1d31032.el7 | 0:3.11.154-1.git.1.1d31032.el7 |
| redhat/atomic-openshift-metrics-server | <0:3.11.154-1.git.1.6a6b6ce.el7 | 0:3.11.154-1.git.1.6a6b6ce.el7 |
| redhat/atomic-openshift-node-problem-detector | <0:3.11.154-1.git.1.5e8e065.el7 | 0:3.11.154-1.git.1.5e8e065.el7 |
| redhat/atomic-openshift-service-idler | <0:3.11.154-1.git.1.f80fb86.el7 | 0:3.11.154-1.git.1.f80fb86.el7 |
| redhat/atomic-openshift-web-console | <0:3.11.154-1.git.1.f54cb18.el7 | 0:3.11.154-1.git.1.f54cb18.el7 |
| redhat/cockpit | <0:195-2.rhaos.el7 | 0:195-2.rhaos.el7 |
| redhat/csi-attacher | <0:0.2.0-4.git27299be.el7 | 0:0.2.0-4.git27299be.el7 |
| redhat/csi-driver-registrar | <0:0.2.0-2.el7 | 0:0.2.0-2.el7 |
| redhat/csi-livenessprobe | <0:0.0.1-2.gitff5b6a0.el7 | 0:0.0.1-2.gitff5b6a0.el7 |
| redhat/csi-provisioner | <0:0.2.0-3.el7 | 0:0.2.0-3.el7 |
| redhat/golang-github-openshift-oauth-proxy | <0:3.11.154-1.git.1.220e3dc.el7 | 0:3.11.154-1.git.1.220e3dc.el7 |
| redhat/golang-github-openshift-prometheus-alert-buffer | <0:0-3.gitceca8c1.el7 | 0:0-3.gitceca8c1.el7 |
| redhat/golang-github-prometheus-alertmanager | <0:3.11.154-1.git.1.4acd2e6.el7 | 0:3.11.154-1.git.1.4acd2e6.el7 |
| redhat/golang-github-prometheus-prometheus | <0:3.11.154-1.git.1.148db48.el7 | 0:3.11.154-1.git.1.148db48.el7 |
| redhat/hawkular-openshift-agent | <0:1.2.2-3.el7 | 0:1.2.2-3.el7 |
| redhat/heapster | <0:1.3.0-4.el7 | 0:1.3.0-4.el7 |
| redhat/image-inspector | <0:2.4.0-4.el7 | 0:2.4.0-4.el7 |
| redhat/openshift-enterprise-autoheal | <0:3.11.154-1.git.1.13199be.el7 | 0:3.11.154-1.git.1.13199be.el7 |
| redhat/openshift-enterprise-cluster-capacity | <0:3.11.154-1.git.1.5798c2c.el7 | 0:3.11.154-1.git.1.5798c2c.el7 |
| redhat/openshift-eventrouter | <0:0.2-4.git7c289cc.el7 | 0:0.2-4.git7c289cc.el7 |
| redhat/openshift-external-storage | <0:0.0.2-9.gitd3c94f0.el7 | 0:0.0.2-9.gitd3c94f0.el7 |
| redhat/ansible-service-broker | <0:1.1.20-2.el7 | 0:1.1.20-2.el7 |
| redhat/atomic-openshift | <0:3.9.101-1.git.0.150f595.el7 | 0:3.9.101-1.git.0.150f595.el7 |
| redhat/atomic-openshift-descheduler | <0:3.9.13-2.git.267.bb59a3f.el7 | 0:3.9.13-2.git.267.bb59a3f.el7 |
| redhat/atomic-openshift-dockerregistry | <0:3.9.101-1.git.1.13625cf.el7 | 0:3.9.101-1.git.1.13625cf.el7 |
| redhat/atomic-openshift-node-problem-detector | <0:3.9.13-2.git.167.5d6b0d4.el7 | 0:3.9.13-2.git.167.5d6b0d4.el7 |
| redhat/atomic-openshift-web-console | <0:3.9.101-1.git.1.601c6d2.el7 | 0:3.9.101-1.git.1.601c6d2.el7 |
| redhat/containernetworking-plugins | <0:0.5.2-6.el7 | 0:0.5.2-6.el7 |
| redhat/cri-o | <0:1.9.16-3.git858756d.el7 | 0:1.9.16-3.git858756d.el7 |
| redhat/cri-tools | <0:1.0.0-6.rhaos3.9.git8e6013a.el7 | 0:1.0.0-6.rhaos3.9.git8e6013a.el7 |
| redhat/golang-github-openshift-oauth-proxy | <0:2.1-3.git885c9f40.el7 | 0:2.1-3.git885c9f40.el7 |
| redhat/golang-github-prometheus-alertmanager | <0:0.14.0-2.git30af4d0.el7 | 0:0.14.0-2.git30af4d0.el7 |
| redhat/golang-github-prometheus-prometheus | <0:2.2.1-2.gitbc6058c.el7 | 0:2.2.1-2.gitbc6058c.el7 |
| redhat/golang-github-prometheus-promu | <0:0-5.git85ceabc.el7 | 0:0-5.git85ceabc.el7 |
| redhat/image-inspector | <0:2.1.3-2.el7 | 0:2.1.3-2.el7 |
| redhat/openshift-enterprise-image-registry | <0:3.8.0-2.git.216.b6b90bb.el7 | 0:3.8.0-2.git.216.b6b90bb.el7 |
| redhat/openshift-eventrouter | <0:0.1-3.git5bd9251.el7 | 0:0.1-3.git5bd9251.el7 |
| redhat/openshift-external-storage | <0:0.0.1-9.git78d6339.el7 | 0:0.0.1-9.git78d6339.el7 |
| redhat/openvswitch-ovn-kubernetes | <0:0.1.0-3.el7 | 0:0.1.0-3.el7 |
| redhat/ansible-service-broker | <1:1.4.4-2.el7 | 1:1.4.4-2.el7 |
| redhat/atomic-enterprise-service-catalog | <1:4.1.14-201908290858.git.1.28cc9ff.el7 | 1:4.1.14-201908290858.git.1.28cc9ff.el7 |
| redhat/openshift | <0:4.1.14-201908290858.git.0.3bd3467.el7 | 0:4.1.14-201908290858.git.0.3bd3467.el7 |
| redhat/cri-o | <0:1.13.11-0.10.dev.rhaos4.1.gitbdeb2ca.el7 | 0:1.13.11-0.10.dev.rhaos4.1.gitbdeb2ca.el7 |
| redhat/cri-tools | <0:1.13.0-3.rhaos4.1.gitb69a0b9.el8 | 0:1.13.0-3.rhaos4.1.gitb69a0b9.el8 |
| redhat/faq | <0:0.0.6-4.el7 | 0:0.0.6-4.el7 |
| redhat/ignition | <0:0.32.0-2.git5941fc0.el8 | 0:0.32.0-2.git5941fc0.el8 |
| redhat/openshift-external-storage | <0:0.0.2-7.gitd3c94f0.el7 | 0:0.0.2-7.gitd3c94f0.el7 |
| redhat/pivot | <0:0.0.5-2.el8 | 0:0.0.5-2.el8 |
| redhat/ansible-operator | <0:0.0.1-3.git.59.4beb3d2.el7 | 0:0.0.1-3.git.59.4beb3d2.el7 |
| redhat/apb | <0:2.0.3-2.el7 | 0:2.0.3-2.el7 |
| redhat/containernetworking-plugins | <0:0.8.1-4.el7 | 0:0.8.1-4.el7 |
| redhat/openshift-eventrouter | <0:0.2-3.gited73fb6.el7 | 0:0.2-3.gited73fb6.el7 |
| redhat/golang-github-prometheus-promu | <0:0.5.0-2.git642a960.el7 | 0:0.5.0-2.git642a960.el7 |
| redhat/skydive | <0:0.20.5-2.el7 | 0:0.20.5-2.el7 |
| redhat/rh-sso7-keycloak | <0:4.8.15-1.Final_redhat_00001.1.el6 | 0:4.8.15-1.Final_redhat_00001.1.el6 |
| redhat/rh-sso7-keycloak | <0:4.8.15-1.Final_redhat_00001.1.el7 | 0:4.8.15-1.Final_redhat_00001.1.el7 |
| redhat/rh-sso7-keycloak | <0:4.8.15-1.Final_redhat_00001.1.el8 | 0:4.8.15-1.Final_redhat_00001.1.el8 |
| redhat/rh-nodejs10 | <0:3.2-3.el7 | 0:3.2-3.el7 |
| redhat/rh-nodejs10-nodejs | <0:10.16.3-3.el7 | 0:10.16.3-3.el7 |
| redhat/rh-nodejs8 | <0:3.0-5.el7 | 0:3.0-5.el7 |
| redhat/rh-nodejs8-nodejs | <0:8.16.1-2.el7 | 0:8.16.1-2.el7 |
| go/golang.org/x/net | <0.0.0-20190813141303-74dc4d7220e7 | 0.0.0-20190813141303-74dc4d7220e7 |
| redhat/envoy | <1.11.1 | 1.11.1 |
| redhat/golang | <1.11.13 | 1.11.13 |
| redhat/golang | <1.12.8 | 1.12.8 |
| redhat/Nodejs | <8.16.1 | 8.16.1 |
| redhat/Nodejs | <10.16.3 | 10.16.3 |
| redhat/Nodejs | <12.8.1 | 12.8.1 |
| redhat/gRPC-Go | <1.21.3 | 1.21.3 |
| redhat/gRPC-Go | <1.22.2 | 1.22.2 |
| redhat/gRPC-Go | <1.23.0 | 1.23.0 |
| All of | ||
| SwiftNIO | >=1.0.0<=1.4.0 | |
| Any of | ||
| Apple iOS and macOS | >=10.12 | |
| Ubuntu | >=14.04 | |
| Apache Traffic Server | >=6.0.0<=6.2.3 | |
| Apache Traffic Server | >=7.0.0<=7.1.6 | |
| Apache Traffic Server | >=8.0.0<=8.0.3 | |
| Debian Linux | =10.0 | |
| Ubuntu | =16.04 | |
| Ubuntu | =18.04 | |
| Ubuntu | =19.04 | |
| Debian Linux | =9.0 | |
| Synology SkyNAS Firmware | ||
| Synology Photos Diskstation Manager | =6.2 | |
| All of | ||
| Synology VS960HD | ||
| Synology VS960HD Firmware | ||
| Red Hat Fedora | =29 | |
| Red Hat Fedora | =30 | |
| SUSE Linux | =15.0 | |
| SUSE Linux | =15.1 | |
| Red Hat Developer Tools | =1.0 | |
| Red Hat JBoss Core Services | =1.0 | |
| JBoss Enterprise Application Platform | =7.2.0 | |
| JBoss Enterprise Application Platform | =7.3.0 | |
| Red Hat OpenShift Container Platform | =3.9 | |
| Red Hat OpenShift Container Platform | =3.10 | |
| Red Hat OpenShift Container Platform | =3.11 | |
| Red Hat OpenShift Container Platform | =4.1 | |
| Red Hat OpenShift Container Platform | =4.2 | |
| Red Hat OpenShift Service Mesh | =1.0 | |
| Red Hat OpenStack for IBM Power | =14 | |
| Red Hat Quay | =3.0.0 | |
| Red Hat Single Sign-On | =7.3 | |
| Red Hat Software Collections | =1.0 | |
| Red Hat Enterprise Linux | =8.0 | |
| Red Hat Enterprise Linux Server EUS | =8.1 | |
| Red Hat Enterprise Linux Server | =7.0 | |
| Red Hat Enterprise Linux Workstation | =7.0 | |
| Oracle GraalVM Enterprise Edition | =19.2.0 | |
| McAfee Web Gateway Cloud Service | >=7.7.2.0<7.7.2.24 | |
| McAfee Web Gateway Cloud Service | >=7.8.2.0<7.8.2.13 | |
| McAfee Web Gateway Cloud Service | >=8.1.0<8.2.0 | |
| NetApp Cloud Insights Telegraf | ||
| NetApp Astra Trident Autosupport | ||
| Riverbed SteelApp Traffic Manager | >=11.6.1<11.6.5.1 | |
| Riverbed SteelApp Traffic Manager | >=12.1.0<12.1.5.1 | |
| Riverbed SteelApp Traffic Manager | >=13.1.0<13.1.3.2 | |
| Riverbed SteelApp Traffic Manager | >=14.0.0<14.0.1.1 | |
| Riverbed SteelApp Traffic Manager | >=14.1.0<14.1.2.1 | |
| Riverbed SteelApp Traffic Manager | >=15.0.0<15.0.1.1 | |
| Node.js | >=8.0.0<=8.8.1 | |
| Node.js | >=8.9.0<8.16.1 | |
| Node.js | >=10.0.0<=10.12.0 | |
| Node.js | >=10.13.0<10.16.3 | |
| Node.js | >=12.0.0<12.8.1 | |
| SwiftNIO | >=1.0.0<=1.4.0 | |
| Apple iOS and macOS | >=10.12 | |
| Ubuntu | >=14.04 | |
| Synology Photos Diskstation Manager | =6.2 | |
| Synology VS960HD | ||
| Synology VS960HD Firmware | ||
| debian/h2o | 2.2.5+dfsg2-6 2.2.5+dfsg2-7 2.2.5+dfsg2-11 | |
| debian/nodejs | 12.22.12~dfsg-1~deb11u4 12.22.12~dfsg-1~deb11u6 18.19.0+dfsg-6~deb12u2 18.19.0+dfsg-6~deb12u1 20.19.0+dfsg-1 20.19.0+dfsg-2 | |
| debian/rust-h2 | <=0.3.13-2 | 0.4.7-3 |
| debian/trafficserver | 8.1.10+ds-1~deb11u1 8.1.11+ds-0+deb11u2 9.2.5+ds-0+deb12u1 9.2.5+ds-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2019-9514 https://nvd.nist.gov/vuln/detail/CVE-2019-9514 https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md https://groups.google.com/forum/#!topic/golang-announce/65QixT3tcmg https://groups.google.com/forum/#!topic/kubernetes-security-announce/wlHLHit1BqA https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/ https://www.mail-archive.com/grpc-io@googlegroups.com/msg06408.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1735744
- https://access.redhat.com/errata/RHSA-2020:0922
- https://access.redhat.com/errata/RHSA-2020:1445
- https://access.redhat.com/errata/RHSA-2020:3196
- https://access.redhat.com/errata/RHSA-2019:2682
- https://access.redhat.com/errata/RHSA-2020:0406
- https://access.redhat.com/errata/RHSA-2019:2726
- https://access.redhat.com/errata/RHSA-2019:2925
- https://access.redhat.com/errata/RHSA-2019:4269
- https://access.redhat.com/errata/RHSA-2019:4273
- https://access.redhat.com/errata/RHSA-2019:4352
- https://access.redhat.com/errata/RHSA-2020:0727
- https://access.redhat.com/errata/RHSA-2019:4021
- https://access.redhat.com/errata/RHSA-2019:4018
- https://access.redhat.com/errata/RHSA-2019:4019
- https://access.redhat.com/errata/RHSA-2019:4020
- https://access.redhat.com/errata/RHSA-2020:2565
- https://access.redhat.com/errata/RHSA-2019:3892
- https://access.redhat.com/errata/RHSA-2020:0983
- https://access.redhat.com/errata/RHSA-2019:2690
- https://access.redhat.com/errata/RHBA-2019:3139
- https://access.redhat.com/errata/RHSA-2019:2817
- https://access.redhat.com/errata/RHSA-2019:3906
- https://access.redhat.com/errata/RHSA-2019:2769
- https://access.redhat.com/errata/RHBA-2019:2819
- https://access.redhat.com/errata/RHSA-2019:2594
- https://access.redhat.com/errata/RHSA-2019:2661
- https://access.redhat.com/errata/RHSA-2019:2766
- https://access.redhat.com/errata/RHSA-2019:2861
- https://access.redhat.com/errata/RHSA-2019:3131
- https://access.redhat.com/errata/RHSA-2019:3265
- https://access.redhat.com/errata/RHSA-2019:3245
- https://access.redhat.com/errata/RHSA-2019:2796
- https://access.redhat.com/errata/RHSA-2020:3197
- https://access.redhat.com/errata/RHSA-2019:2966
- https://access.redhat.com/errata/RHSA-2019:4045
- https://access.redhat.com/errata/RHSA-2019:4040
- https://access.redhat.com/errata/RHSA-2019:4041
- https://access.redhat.com/errata/RHSA-2019:4042
- https://access.redhat.com/errata/RHSA-2019:2939
- https://access.redhat.com/errata/RHSA-2019:2955
- https://access.redhat.com/errata/RHSA-2020:2067
- https://access.redhat.com/security/cve/cve-2019-9514
- https://kb.cert.org/vuls/id/605641/
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19@%3Cannounce.trafficserver.apache.org%3E
- https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7@%3Cdev.trafficserver.apache.org%3E
- https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04@%3Cusers.trafficserver.apache.org%3E
- https://seclists.org/bugtraq/2019/Aug/24
- http://seclists.org/fulldisclosure/2019/Aug/16
- https://www.synology.com/security/advisory/Synology_SA_19_33
- https://seclists.org/bugtraq/2019/Aug/31
- https://support.f5.com/csp/article/K01988340
- https://www.debian.org/security/2019/dsa-4503
- http://www.openwall.com/lists/oss-security/2019/08/20/1
- https://security.netapp.com/advisory/ntap-20190823-0001/
- https://security.netapp.com/advisory/ntap-20190823-0004/
- https://security.netapp.com/advisory/ntap-20190823-0005/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
- https://seclists.org/bugtraq/2019/Aug/43
- https://www.debian.org/security/2019/dsa-4508
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
- https://seclists.org/bugtraq/2019/Sep/18
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- https://www.debian.org/security/2019/dsa-4520
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
- https://support.f5.com/csp/article/K01988340?utm_source=f5support&amp;utm_medium=RSS
- https://usn.ubuntu.com/4308-1/
- https://www.debian.org/security/2020/dsa-4669
- https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html
- http://www.openwall.com/lists/oss-security/2023/10/18/8
- https://launchpad.net/bugs/cve/CVE-2019-9514
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- https://support.f5.com/csp/article/K01988340?utm_source=f5support&utm_medium=RSS
- https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E
- https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E
- https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/
- https://support.f5.com/csp/article/K01988340?utm_source=f5support&%3Butm_medium=RSS
- https://nvd.nist.gov/vuln/detail/CVE-2019-9514
- https://go.dev/cl/190137
- https://go.dev/issue/33606
- https://go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5
- https://groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ
- https://pkg.go.dev/vuln/GO-2022-0536
- https://kb.cert.org/vuls/id/605641
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ
- https://security.netapp.com/advisory/ntap-20190823-0001
- https://security.netapp.com/advisory/ntap-20190823-0004
- https://security.netapp.com/advisory/ntap-20190823-0005
- https://usn.ubuntu.com/4308-1
- https://github.com/advisories/GHSA-39qc-96h7-956f (Advisory)
- https://istio.io/blog/2019/announcing-1.2.4/
- https://github.com/golang/go/issues/33606
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1742310
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1742308
- https://github.com/nodejs/node/commit/477461a51f
- https://github.com/nodejs/node/commit/05dada46ee
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1745595
- https://github.com/golang/go/commit/e152b01a468a1c18a290bf9aec52ccea7693c7f2
- https://github.com/golang/go/commit/7139b45d1410ded14e1e131151fd8dfc435ede6c
- https://github.com/golang/net/commit/b1cc14aba47abf96f96818003fa4caad3a4b4e86
- https://github.com/golang/net/commit/cdfb69ac37fc6fa907650654115ebebb3aae2087
- https://groups.google.com/forum/#!topic/golang-announce/65QixT3tcmg
- https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
- https://groups.google.com/forum/#!topic/kubernetes-security-announce/wlHLHit1BqA
- https://www.mail-archive.com/grpc-io@googlegroups.com/msg06408.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1748603
- https://netty.io/news/2019/08/13/4-1-39-Final.html
- https://access.redhat.com/errata/RHSA-2024:5856
- https://raw.githubusercontent.com/apache/trafficserver/8.0.x/CHANGELOG-8.0.4
- https://github.com/h2o/h2o/issues/2090
- https://github.com/h2o/h2o/commit/743d6b6118c29b75d0b84ef7950a2721c32dfe3f
- https://rustsec.org/advisories/RUSTSEC-2024-0003.html
- https://github.com/hyperium/h2/pull/737
- https://security-tracker.debian.org/tracker/CVE-2019-9514
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514
- https://ubuntu.com/security/CVE-2019-9514
Parent vulnerabilities
(Appears in the following advisories)
- RHSA-2020:0922
- RHSA-2020:1445
- RHSA-2020:3196
- RHSA-2019:2682
- RHSA-2020:0406
- RHSA-2019:2726
- RHSA-2019:2925
- RHSA-2019:4269
- RHSA-2019:4273
- RHSA-2019:4352
- RHSA-2020:0727
- RHSA-2019:4021
- RHSA-2019:4018
- RHSA-2019:4019
- RHSA-2019:4020
- RHSA-2020:2565
- RHSA-2019:3892
- RHSA-2020:0983
- RHSA-2019:2690
- RHBA-2019:3139
- RHSA-2019:2817
- RHSA-2019:3906
- RHSA-2019:2769
- RHBA-2019:2819
- RHSA-2019:2594
- RHSA-2019:2661
- RHSA-2019:2766
- RHSA-2019:2861
- RHSA-2019:3131
- RHSA-2019:3265
- RHSA-2019:3245
- RHSA-2019:2796
- RHSA-2020:3197
- RHSA-2019:2966
- RHSA-2019:4045
- RHSA-2019:4040
- RHSA-2019:4041
- RHSA-2019:4042
- RHSA-2019:2939
- RHSA-2019:2955
- RHSA-2020:2067
Frequently Asked Questions
What is the severity of CVE-2019-9514?
The severity of CVE-2019-9514 is classified as high, primarily affecting system availability through unbounded memory growth.
How do I fix CVE-2019-9514?
To fix CVE-2019-9514, update affected software to the latest versions specified in the remediation section of the vulnerability.
Which software is affected by CVE-2019-9514?
CVE-2019-9514 affects various Red Hat packages including go-toolset, eap7-apache-cxf, containernetworking-plugins, and several versions of the JBoss application server.
What type of attack does CVE-2019-9514 enable?
CVE-2019-9514 enables an attacker to perform a denial-of-service attack by flooding a server with invalid HTTP/2 header frames.
Can CVE-2019-9514 affect both Apache and Go applications?
Yes, CVE-2019-9514 can affect applications using Apache Traffic Server as well as those built with Go language due to mismanagement of HTTP/2.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/weakness
- agent/remedy
- agent/author
- agent/severity
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-39qc-96h7-956f
- alias/CVE-2019-9514
- agent/software-canonical-lookup
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/title
- collector/redhat-bugzilla
- source/Red Hat
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- agent/trending
- agent/last-modified-date
- agent/source
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-cve
- collector/nvd-index
- agent/softwarecombine
- agent/tags
- collector/security-tracker-debian
- source/Debian
- package-manager/redhat
- package-manager/go
- vendor/apple
- canonical/swiftnio
- version/swiftnio/1.0.0
- version/swiftnio/1.4.0
- canonical/apple ios and macos
- version/apple ios and macos/10.12
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/14.04
- vendor/apache
- canonical/apache traffic server
- version/apache traffic server/6.0.0
- version/apache traffic server/6.2.3
- version/apache traffic server/7.0.0
- version/apache traffic server/7.1.6
- version/apache traffic server/8.0.0
- version/apache traffic server/8.0.3
- vendor/debian
- canonical/debian linux
- version/debian linux/10.0
- version/ubuntu/16.04
- version/ubuntu/18.04
- version/ubuntu/19.04
- version/debian linux/9.0
- vendor/synology
- canonical/synology skynas firmware
- canonical/synology photos diskstation manager
- version/synology photos diskstation manager/6.2
- canonical/synology vs960hd
- canonical/synology vs960hd firmware
- vendor/fedoraproject
- canonical/red hat fedora
- version/red hat fedora/29
- version/red hat fedora/30
- vendor/opensuse
- canonical/suse linux
- version/suse linux/15.0
- version/suse linux/15.1
- vendor/redhat
- canonical/red hat developer tools
- version/red hat developer tools/1.0
- canonical/red hat jboss core services
- version/red hat jboss core services/1.0
- canonical/jboss enterprise application platform
- version/jboss enterprise application platform/7.2.0
- version/jboss enterprise application platform/7.3.0
- canonical/red hat openshift container platform
- version/red hat openshift container platform/3.9
- version/red hat openshift container platform/3.10
- version/red hat openshift container platform/3.11
- version/red hat openshift container platform/4.1
- version/red hat openshift container platform/4.2
- canonical/red hat openshift service mesh
- version/red hat openshift service mesh/1.0
- canonical/red hat openstack for ibm power
- version/red hat openstack for ibm power/14
- canonical/red hat quay
- version/red hat quay/3.0.0
- canonical/red hat single sign-on
- version/red hat single sign-on/7.3
- canonical/red hat software collections
- version/red hat software collections/1.0
- canonical/red hat enterprise linux
- version/red hat enterprise linux/8.0
- canonical/red hat enterprise linux server eus
- version/red hat enterprise linux server eus/8.1
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/7.0
- canonical/red hat enterprise linux workstation
- version/red hat enterprise linux workstation/7.0
- vendor/oracle
- canonical/oracle graalvm enterprise edition
- version/oracle graalvm enterprise edition/19.2.0
- vendor/mcafee
- canonical/mcafee web gateway cloud service
- version/mcafee web gateway cloud service/7.7.2.0
- version/mcafee web gateway cloud service/7.8.2.0
- version/mcafee web gateway cloud service/8.1.0
- vendor/netapp
- canonical/netapp cloud insights telegraf
- canonical/netapp astra trident autosupport
- vendor/f5
- canonical/riverbed steelapp traffic manager
- version/riverbed steelapp traffic manager/11.6.1
- version/riverbed steelapp traffic manager/12.1.0
- version/riverbed steelapp traffic manager/13.1.0
- version/riverbed steelapp traffic manager/14.0.0
- version/riverbed steelapp traffic manager/14.1.0
- version/riverbed steelapp traffic manager/15.0.0
- vendor/nodejs
- canonical/node.js
- version/node.js/8.0.0
- version/node.js/8.8.1
- version/node.js/8.9.0
- version/node.js/10.0.0
- version/node.js/10.12.0
- version/node.js/10.13.0
- version/node.js/12.0.0
- package-manager/debian