Bug 1735745 (CVE-2019-9515) - CVE-2019-9515 HTTP/2: flood using SETTINGS frames results in unbounded memory growth
Summary: CVE-2019-9515 HTTP/2: flood using SETTINGS frames results in unbounded memory...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-9515
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1742058 1742059 1742332 1742333 1744742 1744744 1744745 1744746 1744747 1744748 1746645 1746646 1746650 1746652 1746653 1746654 1746659 1746661 1746664 1746901 1748604 1748719 1748720 1749427 1751879 1751880 1752474
Blocks: 1735750
TreeView+ depends on / blocked
 
Reported: 2019-08-01 11:46 UTC by Marian Rehak
Modified: 2024-08-26 11:04 UTC (History)
132 users (show)

Fixed In Version: envoy 1.11.1, Nodejs 8.16.1, Nodejs 10.16.3, Nodejs 12.8.1, gRPC-Go 1.21.3, gRPC-Go 1.22.2, gRPC-Go 1.23.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in HTTP/2. Using SETTINGS frames and queuing of SETTINGS ACK frames, a flood could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2019-09-12 18:45:32 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:2886 0 None None None 2019-09-23 20:05:06 UTC
Red Hat Product Errata RHBA-2019:3289 0 None None None 2019-10-31 17:01:03 UTC
Red Hat Product Errata RHBA-2019:3291 0 None None None 2019-10-31 17:05:01 UTC
Red Hat Product Errata RHSA-2019:2766 0 None None None 2019-09-12 18:33:08 UTC
Red Hat Product Errata RHSA-2019:2796 0 None None None 2019-09-19 02:28:35 UTC
Red Hat Product Errata RHSA-2019:2861 0 None None None 2019-09-26 17:21:39 UTC
Red Hat Product Errata RHSA-2019:2925 0 None None None 2019-09-30 07:22:07 UTC
Red Hat Product Errata RHSA-2019:2939 0 None None None 2019-09-30 23:39:20 UTC
Red Hat Product Errata RHSA-2019:2955 0 None None None 2019-10-02 14:27:01 UTC
Red Hat Product Errata RHSA-2019:3892 0 None None None 2019-11-14 21:18:40 UTC
Red Hat Product Errata RHSA-2019:4018 0 None None None 2019-11-26 19:55:43 UTC
Red Hat Product Errata RHSA-2019:4019 0 None None None 2019-11-26 20:00:03 UTC
Red Hat Product Errata RHSA-2019:4020 0 None None None 2019-11-26 19:57:19 UTC
Red Hat Product Errata RHSA-2019:4021 0 None None None 2019-11-26 19:58:54 UTC
Red Hat Product Errata RHSA-2019:4040 0 None None None 2019-12-02 17:03:36 UTC
Red Hat Product Errata RHSA-2019:4041 0 None None None 2019-12-02 17:03:01 UTC
Red Hat Product Errata RHSA-2019:4042 0 None None None 2019-12-02 17:03:53 UTC
Red Hat Product Errata RHSA-2019:4045 0 None None None 2019-12-02 17:21:36 UTC
Red Hat Product Errata RHSA-2019:4352 0 None None None 2019-12-19 17:38:18 UTC
Red Hat Product Errata RHSA-2020:0727 0 None None None 2020-03-05 12:54:20 UTC
Red Hat Product Errata RHSA-2020:0922 0 None None None 2020-03-23 08:22:12 UTC
Red Hat Product Errata RHSA-2020:0983 0 None None None 2020-03-26 15:48:26 UTC
Red Hat Product Errata RHSA-2020:1445 0 None None None 2020-04-14 13:05:05 UTC
Red Hat Product Errata RHSA-2020:2067 0 None None None 2020-05-18 10:25:40 UTC
Red Hat Product Errata RHSA-2020:2565 0 None None None 2020-06-15 16:18:26 UTC
Red Hat Product Errata RHSA-2020:3196 0 None None None 2020-07-29 06:07:20 UTC
Red Hat Product Errata RHSA-2020:3197 0 None None None 2020-07-29 06:22:23 UTC
Red Hat Product Errata RHSA-2024:5856 0 None None None 2024-08-26 11:04:07 UTC

Description Marian Rehak 2019-08-01 11:46:02 UTC 
HTTP/2 flood using SETTINGS frames and queueing of SETTINGS ACK frames that results in unbounded memory growth.
Comment 1 Marian Rehak 2019-08-09 07:28:01 UTC 
Acknowledgments:

Name: the Envoy security team
Comment 3 Timothy Walsh 2019-08-15 06:30:48 UTC 
https://istio.io/blog/2019/announcing-1.2.4/
Comment 7 msiddiqu 2019-08-16 18:29:45 UTC 
Created nginx tracking bugs for this issue:

Affects: epel-all [bug 1742333]
Affects: fedora-all [bug 1742332]
Comment 12 Marco Benatto 2019-08-22 19:18:19 UTC 
NodeJS upstream commits:
https://github.com/nodejs/node/commit/74507fae34
https://github.com/nodejs/node/commit/0acbe05ee2
Comment 17 Sam Fowler 2019-08-29 04:16:31 UTC 
External References:

https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
https://www.mail-archive.com/grpc-io@googlegroups.com/msg06408.html
Comment 38 Marco Benatto 2019-09-03 21:37:15 UTC 
Created undertow tracking bugs for this issue:

Affects: fedora-all [bug 1748604]
Comment 40 Sam Fowler 2019-09-04 07:06:56 UTC 
Statement:

This issue affects the version of grafana(embeds gRPC) as shipped with Red Hat Ceph Storage 3 as it include the support for HTTP/2.
This flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.

The nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.
Comment 41 Marian Rehak 2019-09-05 10:27:37 UTC 
tracker for fedora-all nginx closed
Comment 44 errata-xmlrpc 2019-09-12 18:33:04 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2019:2766 https://access.redhat.com/errata/RHSA-2019:2766
Comment 45 Product Security DevOps Team 2019-09-12 18:45:32 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-9515
Comment 46 errata-xmlrpc 2019-09-19 02:28:29 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 14.0 (Rocky)

Via RHSA-2019:2796 https://access.redhat.com/errata/RHSA-2019:2796
Comment 50 errata-xmlrpc 2019-09-26 17:21:34 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2019:2861 https://access.redhat.com/errata/RHSA-2019:2861
Comment 51 errata-xmlrpc 2019-09-30 07:22:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:2925 https://access.redhat.com/errata/RHSA-2019:2925
Comment 52 errata-xmlrpc 2019-09-30 23:39:16 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2019:2939 https://access.redhat.com/errata/RHSA-2019:2939
Comment 54 errata-xmlrpc 2019-10-02 14:26:57 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2019:2955 https://access.redhat.com/errata/RHSA-2019:2955
Comment 59 errata-xmlrpc 2019-11-14 21:18:36 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.5.0

Via RHSA-2019:3892 https://access.redhat.com/errata/RHSA-2019:3892
Comment 60 Paramvir jindal 2019-11-19 10:30:57 UTC 
RHSSO component undertow is not affected because undertow-core-2.0.25.SP1-redhat-00001.jar already include the fix and RHSSO component netty seems to be affected as fix version netty seems to be 4.1.39 as per [1] and RHSSO 7.3.4 ships netty-all-4.1.34.Final-redhat-00002.jar :

https://netty.io/news/2019/08/13/4-1-39-Final.html
Comment 64 errata-xmlrpc 2019-11-26 19:55:40 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

Via RHSA-2019:4018 https://access.redhat.com/errata/RHSA-2019:4018
Comment 65 errata-xmlrpc 2019-11-26 19:57:15 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8

Via RHSA-2019:4020 https://access.redhat.com/errata/RHSA-2019:4020
Comment 66 errata-xmlrpc 2019-11-26 19:58:50 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2019:4021 https://access.redhat.com/errata/RHSA-2019:4021
Comment 67 errata-xmlrpc 2019-11-26 19:59:59 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

Via RHSA-2019:4019 https://access.redhat.com/errata/RHSA-2019:4019
Comment 68 errata-xmlrpc 2019-12-02 17:02:57 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3 for RHEL 7

Via RHSA-2019:4041 https://access.redhat.com/errata/RHSA-2019:4041
Comment 69 errata-xmlrpc 2019-12-02 17:03:32 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3 for RHEL 6

Via RHSA-2019:4040 https://access.redhat.com/errata/RHSA-2019:4040
Comment 70 errata-xmlrpc 2019-12-02 17:03:49 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3 for RHEL 8

Via RHSA-2019:4042 https://access.redhat.com/errata/RHSA-2019:4042
Comment 71 errata-xmlrpc 2019-12-02 17:21:32 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On

Via RHSA-2019:4045 https://access.redhat.com/errata/RHSA-2019:4045
Comment 74 errata-xmlrpc 2019-12-19 17:38:14 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 6.3

Via RHSA-2019:4352 https://access.redhat.com/errata/RHSA-2019:4352
Comment 78 errata-xmlrpc 2020-03-05 12:54:15 UTC 
This issue has been addressed in the following products:

  Red Hat Data Grid 7.3.3

Via RHSA-2020:0727 https://access.redhat.com/errata/RHSA-2020:0727
Comment 81 errata-xmlrpc 2020-03-23 08:21:58 UTC 
This issue has been addressed in the following products:

  Red Hat AMQ

Via RHSA-2020:0922 https://access.redhat.com/errata/RHSA-2020:0922
Comment 84 errata-xmlrpc 2020-03-26 15:48:19 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.6.0

Via RHSA-2020:0983 https://access.redhat.com/errata/RHSA-2020:0983
Comment 85 errata-xmlrpc 2020-04-14 13:05:00 UTC 
This issue has been addressed in the following products:

  Red Hat AMQ 7.4.3

Via RHSA-2020:1445 https://access.redhat.com/errata/RHSA-2020:1445
Comment 87 errata-xmlrpc 2020-05-18 10:25:29 UTC 
This issue has been addressed in the following products:

  Red Hat Openshift Application Runtimes

Via RHSA-2020:2067 https://access.redhat.com/errata/RHSA-2020:2067
Comment 88 errata-xmlrpc 2020-06-15 16:18:19 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:2565 https://access.redhat.com/errata/RHSA-2020:2565
Comment 89 errata-xmlrpc 2020-07-29 06:07:14 UTC 
This issue has been addressed in the following products:

  Red Hat Decision Manager

Via RHSA-2020:3196 https://access.redhat.com/errata/RHSA-2020:3196
Comment 90 errata-xmlrpc 2020-07-29 06:22:18 UTC 
This issue has been addressed in the following products:

  Red Hat Process Automation

Via RHSA-2020:3197 https://access.redhat.com/errata/RHSA-2020:3197
Comment 91 errata-xmlrpc 2024-08-26 11:04:00 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

Via RHSA-2024:5856 https://access.redhat.com/errata/RHSA-2024:5856
Note You need to log in before you can comment on or make changes to this bug.