Bug 1735749 (CVE-2019-9518)
| Summary: | CVE-2019-9518 HTTP/2: flood using empty frames results in excessive resource consumption | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | affix, ahardin, aileenc, akoufoud, alazarot, almorale, anstephe, asoldano, ataylor, athmanem, avibelli, bavery, bbaranow, bdettelb, bgeorges, bleanhar, bmaxwell, bmontgom, brian.stansberry, ccoleman, cdewolf, chazlett, dajohnso, darran.lofthouse, dbeveniu, dedgar, dmetzger, dosoudil, drieden, eparis, etirelli, extras-orphan, ganandan, gblomqui, ggaughan, gmainwar, gmccullo, gtanzill, hesilva, hhorak, ibek, iweiss, janstey, jawilson, jbalunas, jburrell, jeremy, jfrey, jgoulding, jhardy, jkaluza, jlaska, jochrist, jokerman, jolee, jorton, jpallich, jperkins, jprause, jschatte, jschorr, jstastny, kconner, kdixon, krathod, kverlaen, kwills, lef, lgao, lthon, luhliari, mchappel, mnovotny, mrunge, msochure, msvehla, mszynkie, mvanderw, nodejs-maint, nodejs-sig, nstielau, nwallace, obarenbo, paradhya, pavel.lisy, pdrozd, peter.borsa, pgallagh, pmackay, psotirop, puntogil, rguimara, roliveri, rrajasek, rruss, rsvoboda, rsynek, sdaley, security-response-team, sgallagh, simaishi, smaestri, sponnaga, sthorger, tchollingsworth, thrcka, tomckay, tom.jenkinson, trogers, twalsh, vhalbert, wtogami, zsvetlik |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | envoy 1.11.1, Nodejs 8.16.1, Nodejs 10.16.3, Nodejs 12.8.1, undertow 2.0.26.SP2, undertow 2.0.27.Final | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in HTTP/2. Using frames with an empty payload, a flood could occur that results in excessive CPU usage and starvation of other clients. The highest threat from this vulnerability is to system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-09-30 18:45:42 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1741969, 1741973, 1742360, 1742363, 1744768, 1744770, 1744771, 1744772, 1744773, 1744774, 1748605 | ||
| Bug Blocks: | 1735750 | ||
|
Description
Marian Rehak
2019-08-01 11:49:08 UTC
Acknowledgments: Name: the Envoy security team Created nodejs tracking bugs for this issue: Affects: epel-all [bug 1741973] Affects: fedora-all [bug 1741969] Created nginx tracking bugs for this issue: Affects: epel-all [bug 1742363] Affects: fedora-all [bug 1742360] External References: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/ NodeJS upstream commit for this issue: https://github.com/nodejs/node/commit/17357d37a9 Created undertow tracking bugs for this issue: Affects: fedora-all [bug 1748605] Statement: This flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections. The nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code. This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:2925 https://access.redhat.com/errata/RHSA-2019:2925 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-9518 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2019:2939 https://access.redhat.com/errata/RHSA-2019:2939 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2019:2955 https://access.redhat.com/errata/RHSA-2019:2955 This issue has been addressed in the following products: Red Hat Fuse 7.5.0 Via RHSA-2019:3892 https://access.redhat.com/errata/RHSA-2019:3892 RHSSO undertow is not affected but RHSSO netty component seems to be affected by this as per: https://netty.io/news/2019/08/13/4-1-39-Final.html This issue has been addressed in the following products: Red Hat Fuse 6.3 Via RHSA-2019:4352 https://access.redhat.com/errata/RHSA-2019:4352 This issue has been addressed in the following products: Red Hat Data Grid 7.3.3 Via RHSA-2020:0727 https://access.redhat.com/errata/RHSA-2020:0727 This issue has been addressed in the following products: Red Hat AMQ Via RHSA-2020:0922 https://access.redhat.com/errata/RHSA-2020:0922 This issue has been addressed in the following products: Red Hat Fuse 7.6.0 Via RHSA-2020:0983 https://access.redhat.com/errata/RHSA-2020:0983 This issue has been addressed in the following products: Red Hat AMQ 7.4.3 Via RHSA-2020:1445 https://access.redhat.com/errata/RHSA-2020:1445 This issue has been addressed in the following products: Red Hat Decision Manager Via RHSA-2020:3196 https://access.redhat.com/errata/RHSA-2020:3196 This issue has been addressed in the following products: Red Hat Process Automation Via RHSA-2020:3197 https://access.redhat.com/errata/RHSA-2020:3197 Marking EAP 7 as being affected but at a low impact, although some artifacts are shipped that contain what we have determined as being vulnerable code but the use of these artifacts in EAP does not expose the vulnerable behaviour i.e. does not result in excessive CPU usage and will not result in a DoS. |