- Vulnerability/
- RHSA-2019:2966
RHSA-2019:2966: Important: Red Hat Quay v3.1.1 security update
First published: Thu Oct 03 2019(Updated: )
Quay 3.1.1 errata release, including:<br>Security Fix(es):<br><li> HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)</li> <li> HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)</li> <li> HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513)</li> <li> HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)</li> <li> HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Bug Fix(es):<br><li> Fixed repository mirror credentials properly escaped to allow special characters</li> <li> Fixed repository mirror UI cancel button enabled</li> <li> Fixed repository mirror UI change next sync date</li>
| Affected Software | Affected Version | How to fix |
|---|
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1735645
- https://bugzilla.redhat.com/show_bug.cgi?id=1735741
- https://bugzilla.redhat.com/show_bug.cgi?id=1735744
- https://bugzilla.redhat.com/show_bug.cgi?id=1741860
- https://bugzilla.redhat.com/show_bug.cgi?id=1741864
- https://bugzilla.redhat.com/show_bug.cgi?id=1750473
- https://access.redhat.com/security/updates/classification/#important
- https://access.redhat.com/errata/RHSA-2019:2966 (Advisory)
Frequently Asked Questions
What are the main security issues addressed in RHSA-2019:2966?
RHSA-2019:2966 addresses multiple security issues in Quay 3.1.1, including denial of service vulnerabilities due to large data requests and unbounded memory growth from PING frames.
What is the severity of RHSA-2019:2966?
The severity of RHSA-2019:2966 is classified as high due to the potential denial of service impacts.
How do I fix RHSA-2019:2966?
To fix RHSA-2019:2966, update Quay to the latest version released by Red Hat that mitigates the identified vulnerabilities.
Are there any workarounds for the vulnerabilities in RHSA-2019:2966?
While it is recommended to apply the update, monitoring traffic and implementing rate limiting are potential workarounds for the vulnerabilities in RHSA-2019:2966.
What versions of Quay are affected by RHSA-2019:2966?
RHSA-2019:2966 affects Quay 3.1.1 and possibly earlier versions that are unfixed.
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2019:2966
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type