CVE-2019-9515

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-9515
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

7.8 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2019/Aug/16 Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2766 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2796 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2861 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2925 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2939 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2955 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3892 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4018 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4019 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4020 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4021 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4040 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4041 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4042 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4045 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4352 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0727 Third Party Advisory
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md Third Party Advisory
https://kb.cert.org/vuls/id/605641/ Third Party Advisory US Government Resource
https://kc.mcafee.com/corporate/index?page=content&id=SB10296 Third Party Advisory
https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E
https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E
https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
https://seclists.org/bugtraq/2019/Aug/24 Mailing List Third Party Advisory
https://seclists.org/bugtraq/2019/Aug/43 Mailing List Third Party Advisory
https://seclists.org/bugtraq/2019/Sep/18 Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20190823-0005/ Third Party Advisory
https://support.f5.com/csp/article/K50233772 Third Party Advisory
https://support.f5.com/csp/article/K50233772?utm_source=f5support&amp%3Butm_medium=RSS
https://usn.ubuntu.com/4308-1/ Third Party Advisory
https://www.debian.org/security/2019/dsa-4508 Third Party Advisory
https://www.debian.org/security/2019/dsa-4520 Third Party Advisory
https://www.synology.com/security/advisory/Synology_SA_19_33 Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html Mailing List Third Party Advisory
https://www.synology.com/security/advisory/Synology_SA_19_33 Third Party Advisory
https://www.debian.org/security/2019/dsa-4520 Third Party Advisory
https://www.debian.org/security/2019/dsa-4508 Third Party Advisory
https://usn.ubuntu.com/4308-1/ Third Party Advisory
https://support.f5.com/csp/article/K50233772?utm_source=f5support&amp%3Butm_medium=RSS
https://support.f5.com/csp/article/K50233772 Third Party Advisory
https://security.netapp.com/advisory/ntap-20190823-0005/ Third Party Advisory
https://seclists.org/bugtraq/2019/Sep/18 Mailing List Third Party Advisory
https://seclists.org/bugtraq/2019/Aug/43 Mailing List Third Party Advisory
https://seclists.org/bugtraq/2019/Aug/24 Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E
https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E
https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E
https://kc.mcafee.com/corporate/index?page=content&id=SB10296 Third Party Advisory
https://kb.cert.org/vuls/id/605641/ Third Party Advisory US Government Resource
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0727 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4352 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4045 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4042 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4041 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4040 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4021 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4020 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4019 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4018 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3892 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2955 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2939 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2925 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2861 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2796 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2766 Third Party Advisory
http://seclists.org/fulldisclosure/2019/Aug/16 Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:synology:skynas:-:*:*:*:*:*:*:*
cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:*

Configuration 7 (hide)

OR cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

Configuration 8 (hide)

OR cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Configuration 9 (hide)

OR cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:*

Configuration 10 (hide)

cpe:2.3:a:oracle:graalvm:19.2.0:*:*:*:enterprise:*:*:*

Configuration 11 (hide)

OR cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*
cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*
cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*

Configuration 12 (hide)

OR cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*

Configuration 13 (hide)

OR cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
History

14 Jan 2025, 19:29

Type Values Removed Values Added
References (CONFIRM) https://kc.mcafee.com/corporate/index?page=content&id=SB10296 - Third Party Advisory () https://kc.mcafee.com/corporate/index?page=content&id=SB10296 - Third Party Advisory
References (BUGTRAQ) https://seclists.org/bugtraq/2019/Sep/18 - Mailing List, Third Party Advisory () https://seclists.org/bugtraq/2019/Sep/18 - Mailing List, Third Party Advisory
References (BUGTRAQ) https://seclists.org/bugtraq/2019/Aug/43 - Mailing List, Third Party Advisory () https://seclists.org/bugtraq/2019/Aug/43 - Mailing List, Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2019/Aug/16 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2019/Aug/16 - Mailing List, Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:2939 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:2939 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:2796 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:2796 - Third Party Advisory
References (DEBIAN) https://www.debian.org/security/2019/dsa-4508 - Third Party Advisory () https://www.debian.org/security/2019/dsa-4508 - Third Party Advisory
References (CONFIRM) https://security.netapp.com/advisory/ntap-20190823-0005/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20190823-0005/ - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:3892 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:3892 - Third Party Advisory
References (CERT-VN) https://kb.cert.org/vuls/id/605641/ - Third Party Advisory, US Government Resource () https://kb.cert.org/vuls/id/605641/ - Third Party Advisory, US Government Resource
References (BUGTRAQ) https://seclists.org/bugtraq/2019/Aug/24 - Mailing List, Third Party Advisory () https://seclists.org/bugtraq/2019/Aug/24 - Mailing List, Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html - Mailing List, Third Party Advisory () http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html - Mailing List, Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:4018 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:4018 - Third Party Advisory
References (CONFIRM) https://support.f5.com/csp/article/K50233772 - Third Party Advisory () https://support.f5.com/csp/article/K50233772 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:4041 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:4041 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:4352 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:4352 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:4040 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:4040 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:4020 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:4020 - Third Party Advisory
References (MISC) https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md - Third Party Advisory () https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md - Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html - Mailing List, Third Party Advisory () http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html - Mailing List, Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:2925 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:2925 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:4042 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:4042 - Third Party Advisory
References (UBUNTU) https://usn.ubuntu.com/4308-1/ - Third Party Advisory () https://usn.ubuntu.com/4308-1/ - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2020:0727 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2020:0727 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:2861 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:2861 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:4045 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:4045 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:4021 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:4021 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:2955 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:2955 - Third Party Advisory
References (DEBIAN) https://www.debian.org/security/2019/dsa-4520 - Third Party Advisory () https://www.debian.org/security/2019/dsa-4520 - Third Party Advisory
References (CONFIRM) https://www.synology.com/security/advisory/Synology_SA_19_33 - Third Party Advisory () https://www.synology.com/security/advisory/Synology_SA_19_33 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:2766 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:2766 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:4019 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:4019 - Third Party Advisory
CPE cpe:2.3:a:synology:diskstation_manager:6.2:*:*:*:*:*:*:* cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:*

07 Nov 2023, 03:13

Type Values Removed Values Added
References
  • {'url': 'https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19@%3Cannounce.trafficserver.apache.org%3E', 'name': '[trafficserver-announce] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacks', 'tags': ['Third Party Advisory'], 'refsource': 'MLIST'}
  • {'url': 'https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7@%3Cdev.trafficserver.apache.org%3E', 'name': '[trafficserver-dev] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacks', 'tags': ['Third Party Advisory'], 'refsource': 'MLIST'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/', 'name': 'FEDORA-2019-6a2980de56', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/', 'name': 'FEDORA-2019-5a6a7bc12c', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04@%3Cusers.trafficserver.apache.org%3E', 'name': '[trafficserver-users] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacks', 'tags': ['Third Party Advisory'], 'refsource': 'MLIST'}
  • {'url': 'https://support.f5.com/csp/article/K50233772?utm_source=f5support&utm_medium=RSS', 'name': 'https://support.f5.com/csp/article/K50233772?utm_source=f5support&utm_medium=RSS', 'tags': ['Third Party Advisory'], 'refsource': 'CONFIRM'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/ -
  • () https://support.f5.com/csp/article/K50233772?utm_source=f5support&amp%3Butm_medium=RSS -
  • () https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E -
  • () https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E -
  • () https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/ -
Information

Published : 2019-08-13 21:15

Updated : 2025-01-14 19:29

NVD link : CVE-2019-9515

Mitre link : CVE-2019-9515

JSON object : View

Products Affected

synology

  • skynas
  • diskstation_manager
  • vs960hd
  • vs960hd_firmware

redhat

  • openstack
  • openshift_container_platform
  • single_sign-on
  • software_collections
  • jboss_core_services
  • enterprise_linux
  • quay
  • openshift_service_mesh
  • jboss_enterprise_application_platform

canonical

  • ubuntu_linux

nodejs

  • node.js

debian

  • debian_linux

fedoraproject

  • fedora

apple

  • swiftnio
  • mac_os_x

f5

  • big-ip_local_traffic_manager

opensuse

  • leap

oracle

  • graalvm

mcafee

  • web_gateway

apache

  • traffic_server
CWE
CWE-770

Allocation of Resources Without Limits or Throttling