Bug 1735744 (CVE-2019-9514)
| Summary: | CVE-2019-9514 HTTP/2: flood using HEADERS frames results in unbounded memory growth | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aboyko, admiller, affix, ahardin, aileenc, akoufoud, alazarot, almorale, amurdaca, anstephe, aos-bugs, aos-odin-bot, aos-storage-staff, asm, asoldano, atangrin, ataylor, athmanem, avibelli, bavery, bbaranow, bbaude, bbennett, bbreard, bdettelb, bgeorges, bleanhar, bmaxwell, bmontgom, bodavis, brian.stansberry, ccoleman, cdewolf, chazlett, chris.liles, dajohnso, darran.lofthouse, dbecker, dbeveniu, dedgar, deparker, dkreling, dmetzger, dominik.mierzejewski, dosoudil, drieden, dustymabe, dwalsh, emachado, eparis, etirelli, extras-orphan, fpokorny, ganandan, gblomqui, ggaughan, gmainwar, gmccullo, go-sig, gtanzill, hchiramm, hesilva, hhorak, hvyas, ibek, ichavero, imcleod, iweiss, janstey, jawilson, jbalunas, jbrooks, jburrell, jcajka, jchaloup, jeremy, jfrey, jgoulding, jhardy, jjoyce, jkaluza, jlaska, jligon, jmulligan, jnovy, jochrist, jokerman, jolee, jorton, jpadman, jpallich, jperkins, jprause, jschatte, jschluet, jschorr, jstastny, jwon, kbasil, kconner, kdixon, kmullins, kramdoss, krathod, kverlaen, kwills, law, lef, lemenkov, lgao, lhh, lpeer, lpetrovi, lsm5, lthon, luhliari, madam, mbenatto, mburns, mchappel, mheon, miabbott, mnewsome, mnovotny, mrunge, msochure, msvehla, mszynkie, mvanderw, nhorman, nodejs-maint, nodejs-sig, nstielau, nwallace, obarenbo, paradhya, pavel.lisy, pdrozd, pegoncal, peter.borsa, pgallagh, pjindal, pmackay, psotirop, puebele, puntogil, renich, rguimara, rhs-bugs, roliveri, rphillips, rrajasek, rruss, rstancel, rsvoboda, rsynek, safchain, sclewis, sdaley, security-response-team, sgallagh, shurley, simaishi, sisharma, slinaber, smaestri, sponnaga, sthorger, storage-qa-internal, strigazi, tchollingsworth, thrcka, tomckay, tom.jenkinson, trogers, tstclair, tstellar, twalsh, vbatts, vbellur, vhalbert, wtogami, yozone, zsvetlik |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | impact=important,public=20190813:1700,reported=20190801,source=upstream,cvss3=7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,cwe=CWE-400,ossm-0/maistra=affected,epel-all/golang=affected,fedora-all/golang=affected,openshift-online-3/golang=notaffected,ceph-2/golang=affected/impact=moderate,ceph-3/golang=affected/impact=moderate,rhel-7/golang=affected,rhel-8/go-toolset:rhel8/golang=affected,rhes-3/golang=affected/impact=moderate,openstack-9-optools/golang=wontfix,openshift-enterprise-3.9/golang-rpms=affected,openshift-enterprise-3.10/atomic-openshift=affected,openshift-enterprise-3.11/golang-rpms=affected,openshift-enterprise-4.1/openshift=affected,openshift-4.2/golang-rpms=affected,openshift-enterprise-4.1/golang-images=affected,openshift-4.2/golang-images=affected,openshift-enterprise-4.1/multus-cni-container/grpc=affected,openshift-enterprise-4.1/sriov-network-device-plugin-container/grpc=affected,openshift-enterprise-4.1/operator-lifecycle-manager-container/grpc=affected,openshift-enterprise-4.1/operator-registry-container/grpc=affected,openshift-enterprise-4.1/cri-o=affected,openshift-enterprise-4.1/cri-tools=affected,openshift-enterprise-4.1/faq=affected,openshift-enterprise-4.1/ignition=affected,openshift-enterprise-4.1/openshift-external-storage=affected,openshift-enterprise-4.1/pivot=affected,openshift-enterprise-4.1/openshift-eventrouter=affected,openshift-enterprise-4.1/golang-github-openshift-prometheus-alert-buffer=affected,openshift-enterprise-4.1/golang-github-prometheus-promu=affected,openshift-enterprise-4.1/ansible-operator=affected,openshift-enterprise-4.1/ansible-service-broker=affected,openshift-enterprise-4.1/apb=affected,openshift-enterprise-4.1/containernetworking-plugins=affected,openshift-4.2/multus-cni-container/grpc=affected,openshift-4.2/node-feature-discovery/grpc=affected,openshift-4.2/sriov-network-device-plugin-container/grpc=affected,openshift-4.2/operator-lifecycle-manager-container/grpc=affected,openshift-4.2/operator-registry-container/grpc=affected,rhes-3/heketi=affected/impact=moderate,ceph-3/grafana=affected/impact=moderate,openshift-enterprise-3.10/nodejs=notaffected,openshift-enterprise-3.9/nodejs=notaffected,quay-3/nodejs=notaffected,fedora-all/nodejs=affected,epel-all/nodejs=affected,rhel-8/nodejs:10/nodejs=affected,rhscl-3/rh-nodejs10-nodejs=affected,rhscl-3/rh-nodejs8-nodejs=affected,rhoar-nodejs-8/rhoar-nodejs=new,amq-7/netty=affected,jdg-7/netty=affected,jdv-6/netty=notaffected,fuse-7/netty=affected,fuse-6/netty=affected,rhdm-7/netty=affected,rhpam-7/netty=affected,fedora-all/nginx=affected,epel-all/nginx=affected,openshift-online-3/nginx=notaffected,cfme-5/nginx=notaffected,ansible_tower-3/nginx=notaffected,rhel-8/nginx:1.14/nginx=notaffected,rhscl-3/rh-nginx110-nginx=notaffected,rhscl-3/rh-nginx112-nginx=notaffected,rhscl-3/rh-nginx114-nginx=notaffected,rhsso-7/netty=new,devtools-compilers/golang=affected,vertx-3/netty=affected,fedora-all/kubernetes=affected,ceph-2/grafana=notaffected,rhes-3/grafana=notaffected,vertx-3/grpc=affected,amq-st/grpc=notaffected,fuse-7/grpc=affected,swarm-7/undertow=new,rhsso-7/undertow=new,rhpam-7/undertow=new,fuse-6/undertow=wontfix/impact=moderate,fuse-7/undertow=affected,jdg-7/undertow=notaffected,eap-6/jbossweb=notaffected,eap-7/undertow=affected,fedora-all/undertow=affected,openstack-14/skydive=affected,openshift-enterprise-4.1/golang-rpms=affected,openshift-enterprise-3.10/golang-rpms=affected,quay-3/clair-jwt=affected,quay-3/quay-builder=new,quay-3/quay=affected,amq-7/jetty=affected/impact=moderate/cvss3=5.3/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H,openshift-enterprise-3.9/cockpit=affected | ||
| Fixed In Version: | envoy 1.11.1, golang 1.11.13, golang 1.12.8, Nodejs 8.16.1, Nodejs 10.16.3, Nodejs 12.8.1, gRPC-Go 1.21.3, gRPC-Go 1.22.2, gRPC-Go 1.23.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in HTTP/2. Using HEADER frames with invalid HTTP headers and queuing of response RST_STREAM frames, an attacker could cause a flood resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-09-10 18:45:40 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1766332, 1741826, 1741827, 1742039, 1742041, 1742308, 1742310, 1743204, 1743205, 1743470, 1743472, 1743473, 1743906, 1744729, 1744731, 1744732, 1744733, 1744734, 1744735, 1745595, 1745703, 1745704, 1745705, 1745706, 1746493, 1746494, 1746495, 1746496, 1746498, 1746638, 1746640, 1746645, 1746646, 1746650, 1746652, 1746653, 1746654, 1746659, 1746661, 1746664, 1748603, 1748717, 1748718, 1749141, 1749427, 1751879, 1751880, 1752474, 1753278, 1753452, 1761818, 1761819, 1761820, 1761821, 1761822, 1761823, 1761824, 1761825, 1761826, 1761827, 1761828, 1761829, 1761830, 1761832, 1761873, 1762051, 1762052, 1762053, 1762054, 1762055, 1762056, 1762057, 1762058, 1762059, 1762060, 1762061, 1762062, 1762063, 1762064, 1762065, 1762066, 1762067, 1762068, 1762069, 1762070, 1762071, 1762072, 1762073, 1762074, 1762075, 1762076, 1762077, 1762078, 1762079, 1762080, 1762082, 1762088, 1762089, 1762090, 1762091, 1762092, 1762093, 1762094, 1762095, 1762096, 1762097, 1762098, 1762099, 1762100, 1762101, 1762102, 1762103, 1762104, 1762105, 1762106, 1762107, 1762108, 1762109, 1762110, 1762111, 1762112, 1762113, 1762114, 1762115, 1762116, 1762117, 1762118, 1762121, 1762122, 1762123, 1764859, 1766308, 1766309, 1766310, 1766311, 1766312, 1766313, 1766314, 1766315, 1766316, 1766317, 1766318, 1766319, 1766320, 1766321, 1766322, 1766323, 1766324, 1766325, 1766326, 1766327, 1766328, 1766329, 1766330, 1766331, 1766333, 1766334, 1772134, 1772135, 1772136, 1772137, 1789849, 1789850, 1790646, 1790647 | ||
| Bug Blocks: | 1735750 | ||
|
Description
Marian Rehak
2019-08-01 11:43:33 UTC
Acknowledgments: Name: the Envoy security team Golang issue: https://github.com/golang/go/issues/33606 Created nginx tracking bugs for this issue: Affects: epel-all [bug 1742310] Affects: fedora-all [bug 1742308] NodeJS upstream commit related to this CVE: https://github.com/nodejs/node/commit/477461a51f https://github.com/nodejs/node/commit/05dada46ee Created kubernetes tracking bugs for this issue: Affects: fedora-all [bug 1745595] All golang upstream patches: net/http/ https://github.com/golang/go/commit/e152b01a468a1c18a290bf9aec52ccea7693c7f2 [1.11] https://github.com/golang/go/commit/7139b45d1410ded14e1e131151fd8dfc435ede6c [1.12] x/net/http2 https://github.com/golang/net/commit/b1cc14aba47abf96f96818003fa4caad3a4b4e86 [1.11] https://github.com/golang/net/commit/cdfb69ac37fc6fa907650654115ebebb3aae2087 [1.12] External References: https://groups.google.com/forum/#!topic/golang-announce/65QixT3tcmg https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/ https://groups.google.com/forum/#!topic/kubernetes-security-announce/wlHLHit1BqA https://www.mail-archive.com/grpc-io@googlegroups.com/msg06408.html Created undertow tracking bugs for this issue: Affects: fedora-all [bug 1748603] tracker for fedora-all nginx closed This issue has been addressed in the following products: Red Hat Developer Tools Via RHSA-2019:2682 https://access.redhat.com/errata/RHSA-2019:2682 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:2726 https://access.redhat.com/errata/RHSA-2019:2726 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.1 Via RHSA-2019:2594 https://access.redhat.com/errata/RHSA-2019:2594 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-9514 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.1 Via RHSA-2019:2661 https://access.redhat.com/errata/RHSA-2019:2661 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.10 Via RHSA-2019:2690 https://access.redhat.com/errata/RHSA-2019:2690 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.1 Via RHSA-2019:2766 https://access.redhat.com/errata/RHSA-2019:2766 This issue has been addressed in the following products: Red Hat OpenStack Platform 14.0 (Rocky) Via RHSA-2019:2796 https://access.redhat.com/errata/RHSA-2019:2796 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.1 Via RHSA-2019:2861 https://access.redhat.com/errata/RHSA-2019:2861 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:2925 https://access.redhat.com/errata/RHSA-2019:2925 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2019:2939 https://access.redhat.com/errata/RHSA-2019:2939 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2019:2955 https://access.redhat.com/errata/RHSA-2019:2955 This issue has been addressed in the following products: Red Hat Quay 3 Via RHSA-2019:2966 https://access.redhat.com/errata/RHSA-2019:2966 Statement: The golang package in Red Hat OpenStack Platform 9 Operational Tools will not be updated for this flaw because it is in technical preview and is retiring as of 24.Aug.2019. This issue did not affect the versions of grafana(embeds golang) as shipped with Red Hat Ceph Storage 2 and Red Hat Gluster Storage 3 as they did not include the support for HTTP/2. The following storage product versions are affected because they include the support for HTTP/2 in: * golang as shipped with Red Hat Gluster Storage 3, Red Hat Ceph Storage 2 and Red Hat Ceph Storage 3 * heketi(embeds golang) as shipped with Red Hat Gluster Storage 3 * grafana(embeds golang and grpc) as shipped with Red Hat Ceph Storage 3 This flaw has no available mitigation for packages golang and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections. The nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code. All OpenShift Container Platform RPMs and container images that are built with Go and support HTTP/2 are vulnerable to this flaw. This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.1 Via RHSA-2019:3131 https://access.redhat.com/errata/RHSA-2019:3131 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.9 Via RHSA-2019:2769 https://access.redhat.com/errata/RHSA-2019:2769 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.2 Via RHSA-2019:3245 https://access.redhat.com/errata/RHSA-2019:3245 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.1 Via RHSA-2019:3265 https://access.redhat.com/errata/RHSA-2019:3265 This issue has been addressed in the following products: Red Hat Fuse 7.5.0 Via RHSA-2019:3892 https://access.redhat.com/errata/RHSA-2019:3892 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.11 Via RHSA-2019:3906 https://access.redhat.com/errata/RHSA-2019:3906 RHSSO component undertow is not affected because undertow-core-2.0.25.SP1-redhat-00001.jar already include the fix and RHSSO component netty seems to be affected as fix version netty seems to be 4.1.39 as per [1] and RHSSO 7.3.4 ships netty-all-4.1.34.Final-redhat-00002.jar : https://netty.io/news/2019/08/13/4-1-39-Final.html This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 Via RHSA-2019:4018 https://access.redhat.com/errata/RHSA-2019:4018 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 Via RHSA-2019:4020 https://access.redhat.com/errata/RHSA-2019:4020 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2019:4021 https://access.redhat.com/errata/RHSA-2019:4021 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 Via RHSA-2019:4019 https://access.redhat.com/errata/RHSA-2019:4019 This issue has been addressed in the following products: Red Hat Single Sign-On 7.3 for RHEL 7 Via RHSA-2019:4041 https://access.redhat.com/errata/RHSA-2019:4041 This issue has been addressed in the following products: Red Hat Single Sign-On 7.3 for RHEL 6 Via RHSA-2019:4040 https://access.redhat.com/errata/RHSA-2019:4040 This issue has been addressed in the following products: Red Hat Single Sign-On 7.3 for RHEL 8 Via RHSA-2019:4042 https://access.redhat.com/errata/RHSA-2019:4042 This issue has been addressed in the following products: Red Hat Single Sign-On Via RHSA-2019:4045 https://access.redhat.com/errata/RHSA-2019:4045 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:4269 https://access.redhat.com/errata/RHSA-2019:4269 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:4273 https://access.redhat.com/errata/RHSA-2019:4273 This issue has been addressed in the following products: Red Hat Fuse 6.3 Via RHSA-2019:4352 https://access.redhat.com/errata/RHSA-2019:4352 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extras Via RHSA-2020:0406 https://access.redhat.com/errata/RHSA-2020:0406 This issue has been addressed in the following products: Red Hat Data Grid 7.3.3 Via RHSA-2020:0727 https://access.redhat.com/errata/RHSA-2020:0727 This issue has been addressed in the following products: Red Hat AMQ Via RHSA-2020:0922 https://access.redhat.com/errata/RHSA-2020:0922 This issue has been addressed in the following products: Red Hat Fuse 7.6.0 Via RHSA-2020:0983 https://access.redhat.com/errata/RHSA-2020:0983 This issue has been addressed in the following products: Red Hat AMQ 7.4.3 Via RHSA-2020:1445 https://access.redhat.com/errata/RHSA-2020:1445 This issue has been addressed in the following products: Red Hat Openshift Application Runtimes Via RHSA-2020:2067 https://access.redhat.com/errata/RHSA-2020:2067 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2020:2565 https://access.redhat.com/errata/RHSA-2020:2565 This issue has been addressed in the following products: Red Hat Decision Manager Via RHSA-2020:3196 https://access.redhat.com/errata/RHSA-2020:3196 This issue has been addressed in the following products: Red Hat Process Automation Via RHSA-2020:3197 https://access.redhat.com/errata/RHSA-2020:3197 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Via RHSA-2024:5856 https://access.redhat.com/errata/RHSA-2024:5856 |