CVE-2019-9516: Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service
First published: Tue Aug 13 2019(Updated: )
A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.
Credit: cret@cert.org cret@cert.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/jbcs-httpd24-httpd | <0:2.4.29-41.jbcs.el6 | 0:2.4.29-41.jbcs.el6 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.39.2-1.jbcs.el6 | 0:1.39.2-1.jbcs.el6 |
| redhat/jbcs-httpd24-apr | <0:1.6.3-63.jbcs.el6 | 0:1.6.3-63.jbcs.el6 |
| redhat/jbcs-httpd24-apr-util | <0:1.6.1-48.jbcs.el6 | 0:1.6.1-48.jbcs.el6 |
| redhat/jbcs-httpd24-brotli | <0:1.0.6-7.jbcs.el6 | 0:1.0.6-7.jbcs.el6 |
| redhat/jbcs-httpd24-curl | <0:7.64.1-14.jbcs.el6 | 0:7.64.1-14.jbcs.el6 |
| redhat/jbcs-httpd24-httpd | <0:2.4.37-33.jbcs.el6 | 0:2.4.37-33.jbcs.el6 |
| redhat/jbcs-httpd24-jansson | <0:2.11-20.jbcs.el6 | 0:2.11-20.jbcs.el6 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.39.2-4.jbcs.el6 | 0:1.39.2-4.jbcs.el6 |
| redhat/jbcs-httpd24-openssl | <1:1.1.1-25.jbcs.el6 | 1:1.1.1-25.jbcs.el6 |
| redhat/jbcs-httpd24-httpd | <0:2.4.29-41.jbcs.el7 | 0:2.4.29-41.jbcs.el7 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.39.2-1.jbcs.el7 | 0:1.39.2-1.jbcs.el7 |
| redhat/jbcs-httpd24-apr | <0:1.6.3-63.jbcs.el7 | 0:1.6.3-63.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util | <0:1.6.1-48.jbcs.el7 | 0:1.6.1-48.jbcs.el7 |
| redhat/jbcs-httpd24-brotli | <0:1.0.6-7.jbcs.el7 | 0:1.0.6-7.jbcs.el7 |
| redhat/jbcs-httpd24-curl | <0:7.64.1-14.jbcs.el7 | 0:7.64.1-14.jbcs.el7 |
| redhat/jbcs-httpd24-httpd | <0:2.4.37-33.jbcs.el7 | 0:2.4.37-33.jbcs.el7 |
| redhat/jbcs-httpd24-jansson | <0:2.11-20.jbcs.el7 | 0:2.11-20.jbcs.el7 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.39.2-4.jbcs.el7 | 0:1.39.2-4.jbcs.el7 |
| redhat/jbcs-httpd24-openssl | <1:1.1.1-25.jbcs.el7 | 1:1.1.1-25.jbcs.el7 |
| redhat/rh-nginx110-nginx | <1:1.10.2-9.el6.1 | 1:1.10.2-9.el6.1 |
| redhat/rh-nginx110-nginx | <1:1.10.2-9.el7.1 | 1:1.10.2-9.el7.1 |
| redhat/rh-nginx112-nginx | <1:1.12.1-3.el7.1 | 1:1.12.1-3.el7.1 |
| redhat/rh-nginx114-nginx | <1:1.14.1-1.el7.1 | 1:1.14.1-1.el7.1 |
| redhat/rh-nodejs10 | <0:3.2-3.el7 | 0:3.2-3.el7 |
| redhat/rh-nodejs10-nodejs | <0:10.16.3-3.el7 | 0:10.16.3-3.el7 |
| redhat/rh-nodejs8 | <0:3.0-5.el7 | 0:3.0-5.el7 |
| redhat/rh-nodejs8-nodejs | <0:8.16.1-2.el7 | 0:8.16.1-2.el7 |
| redhat/Nodejs | <8.16.1 | 8.16.1 |
| redhat/Nodejs | <10.16.3 | 10.16.3 |
| redhat/Nodejs | <12.8.1 | 12.8.1 |
| redhat/nginx | <1.16.1 | 1.16.1 |
| redhat/nginx | <1.17.3 | 1.17.3 |
| All of | ||
| Apple Swiftnio | >=1.0.0<=1.4.0 | |
| Any of | ||
| Apple Mac OS X | >=10.12 | |
| Canonical Ubuntu Linux | >=14.04 | |
| Apache Traffic Server | >=6.0.0<=6.2.3 | |
| Apache Traffic Server | >=7.0.0<=7.1.6 | |
| Apache Traffic Server | >=8.0.0<=8.0.3 | |
| Canonical Ubuntu Linux | =16.04 | |
| Canonical Ubuntu Linux | =18.04 | |
| Canonical Ubuntu Linux | =19.04 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| Fedoraproject Fedora | =30 | |
| Synology DiskStation Manager | =6.2 | |
| Synology Skynas | ||
| All of | ||
| Synology Vs960hd Firmware | ||
| Synology Vs960hd | ||
| Fedoraproject Fedora | =29 | |
| Fedoraproject Fedora | =32 | |
| openSUSE Leap | =15.0 | |
| openSUSE Leap | =15.1 | |
| Redhat Jboss Core Services | =1.0 | |
| Redhat Jboss Enterprise Application Platform | =7.2.0 | |
| Redhat Jboss Enterprise Application Platform | =7.3.0 | |
| Redhat Openshift Service Mesh | =1.0 | |
| Redhat Quay | =3.0.0 | |
| Redhat Software Collections | =1.0 | |
| Redhat Enterprise Linux | =8.0 | |
| Oracle GraalVM | =19.2.0 | |
| McAfee Web Gateway | >=7.7.2.0<7.7.2.24 | |
| McAfee Web Gateway | >=7.8.2.0<7.8.2.13 | |
| McAfee Web Gateway | >=8.1.0<8.2.0 | |
| F5 Nginx | >=1.9.5<1.16.1 | |
| F5 Nginx | >=1.17.0<=1.17.2 | |
| Nodejs Node.js | >=8.0.0<8.16.1 | |
| Nodejs Node.js | >=10.0.0<10.16.3 | |
| Nodejs Node.js | >=12.0.0<12.8.1 | |
| Apple Swiftnio | >=1.0.0<=1.4.0 | |
| Apple Mac OS X | >=10.12 | |
| Canonical Ubuntu Linux | >=14.04 | |
| Synology Vs960hd Firmware | ||
| Synology Vs960hd | ||
| debian/nginx | 1.18.0-6.1+deb11u3 1.22.1-9 1.26.0-3 |
Remedy
Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions: 1. Copy the Nginx configuration from the quay container to the host $ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx 2. Edit the Nginx configuration, removing http/2 support $ sed -i 's/http2 //g' /mnt/quay/nginx/nginx.conf 3. Restart Nginx with the new configuration mounted into the container, eg: $ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2019-9516 https://nvd.nist.gov/vuln/detail/CVE-2019-9516 https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md https://github.com/nghttp2/nghttp2/issues/1382# https://kb.cert.org/vuls/id/605641/ https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/ https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
- https://bugzilla.redhat.com/show_bug.cgi?id=1741864
- https://access.redhat.com/errata/RHSA-2019:2946
- https://access.redhat.com/errata/RHSA-2019:3932
- https://access.redhat.com/errata/RHSA-2019:3933
- https://access.redhat.com/errata/RHSA-2020:0922
- https://access.redhat.com/errata/RHSA-2020:1445
- https://access.redhat.com/errata/RHSA-2019:2799
- https://access.redhat.com/errata/RHSA-2019:2925
- https://access.redhat.com/errata/RHSA-2019:2950
- https://access.redhat.com/errata/RHSA-2019:3935
- https://access.redhat.com/errata/RHSA-2020:0983
- https://access.redhat.com/errata/RHSA-2019:2966
- https://access.redhat.com/errata/RHSA-2019:2745
- https://access.redhat.com/errata/RHSA-2019:2746
- https://access.redhat.com/errata/RHSA-2019:2775
- https://access.redhat.com/errata/RHSA-2019:2939
- https://access.redhat.com/errata/RHSA-2019:2955
- https://access.redhat.com/security/cve/cve-2019-9516
- https://kb.cert.org/vuls/id/605641/
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- https://seclists.org/bugtraq/2019/Aug/24
- https://usn.ubuntu.com/4099-1/
- http://seclists.org/fulldisclosure/2019/Aug/16
- https://www.synology.com/security/advisory/Synology_SA_19_33
- https://support.f5.com/csp/article/K02591030
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/
- https://seclists.org/bugtraq/2019/Aug/40
- https://security.netapp.com/advisory/ntap-20190823-0002/
- https://security.netapp.com/advisory/ntap-20190823-0005/
- https://www.debian.org/security/2019/dsa-4505
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html
- https://support.f5.com/csp/article/K02591030?utm_source=f5support&amp;utm_medium=RSS
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/
- https://launchpad.net/bugs/cve/CVE-2019-9516
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741866
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741948
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741947
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741950
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741980
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741979
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1742380
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1742381
- https://github.com/nodejs/node/commit/f4242e24f9
- http://hg.nginx.org/nginx/rev/4f4b83f00cf1
- https://github.com/icing/mod_h2/commit/dd05d49abe0f67512ce9ed5ba422d7711effecfb
- https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
- https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
- https://github.com/nghttp2/nghttp2/issues/1382
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1748607
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/
- https://support.f5.com/csp/article/K02591030?utm_source=f5support&%3Butm_medium=RSS
- https://support.f5.com/csp/article/K02591030?utm_source=f5support&utm_medium=RSS
- https://github.com/nginx/nginx/commit/6dfbc8b1c2116f362bb871efebbf9df576738e89
- https://github.com/nginx/nginx/commit/dbdd9ffea81d9db46fb88b5eba828f2ad080d388
- https://security-tracker.debian.org/tracker/CVE-2019-9516
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9516
- https://nvd.nist.gov/vuln/detail/CVE-2019-9516
- https://ubuntu.com/security/CVE-2019-9516
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2019-9516?
CVE-2019-9516 is a vulnerability in HTTP/2 that allows an attacker to cause a denial of service.
How does CVE-2019-9516 work?
CVE-2019-9516 works by sending a stream of headers with 0-length header names and values, potentially causing a header leak and leading to a denial of service.
Which software is affected by CVE-2019-9516?
Node.js versions up to 8.16.1, 10.16.3, and 12.8.1, as well as Nginx versions 1.16.1 and 1.17.3 are affected by CVE-2019-9516.
How severe is CVE-2019-9516?
CVE-2019-9516 has a severity rating of high, with a CVSS score of 6.5.
Are there any references for CVE-2019-9516?
Yes, you can find references for CVE-2019-9516 in the following links: [link1], [link2], [link3].
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/weakness
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-9516
- agent/software-canonical-lookup
- agent/remedy
- agent/description
- agent/references
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/last-modified-date
- agent/event
- agent/tags
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- package-manager/redhat
- vendor/apple
- canonical/apple swiftnio
- version/apple swiftnio/1.0.0
- version/apple swiftnio/1.4.0
- canonical/apple mac os x
- version/apple mac os x/10.12
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/14.04
- vendor/apache
- canonical/apache traffic server
- version/apache traffic server/6.0.0
- version/apache traffic server/6.2.3
- version/apache traffic server/7.0.0
- version/apache traffic server/7.1.6
- version/apache traffic server/8.0.0
- version/apache traffic server/8.0.3
- version/canonical ubuntu linux/16.04
- version/canonical ubuntu linux/18.04
- version/canonical ubuntu linux/19.04
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/30
- vendor/synology
- canonical/synology diskstation manager
- version/synology diskstation manager/6.2
- canonical/synology skynas
- canonical/synology vs960hd firmware
- canonical/synology vs960hd
- version/fedoraproject fedora/29
- version/fedoraproject fedora/32
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/15.0
- version/opensuse leap/15.1
- vendor/redhat
- canonical/redhat jboss core services
- version/redhat jboss core services/1.0
- canonical/redhat jboss enterprise application platform
- version/redhat jboss enterprise application platform/7.2.0
- version/redhat jboss enterprise application platform/7.3.0
- canonical/redhat openshift service mesh
- version/redhat openshift service mesh/1.0
- canonical/redhat quay
- version/redhat quay/3.0.0
- canonical/redhat software collections
- version/redhat software collections/1.0
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0
- vendor/oracle
- canonical/oracle graalvm
- version/oracle graalvm/19.2.0
- vendor/mcafee
- canonical/mcafee web gateway
- version/mcafee web gateway/7.7.2.0
- version/mcafee web gateway/7.8.2.0
- version/mcafee web gateway/8.1.0
- vendor/f5
- canonical/f5 nginx
- version/f5 nginx/1.9.5
- version/f5 nginx/1.17.0
- version/f5 nginx/1.17.2
- vendor/nodejs
- canonical/nodejs node.js
- version/nodejs node.js/8.0.0
- version/nodejs node.js/10.0.0
- version/nodejs node.js/12.0.0
- package-manager/debian