Bug 1735645 (CVE-2019-9512) - CVE-2019-9512 HTTP/2: flood using PING frames results in unbounded memory growth
Summary: CVE-2019-9512 HTTP/2: flood using PING frames results in unbounded memory growth
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-9512
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20190813:1700...
Depends On: 1766288 1741815 1741816 1741988 1741989 1741996 1741997 1742245 1742247 1743206 1743207 1743470 1743472 1743473 1744305 1744306 1744307 1744308 1744309 1744310 1745594 1745709 1745710 1745711 1745712 1746484 1746485 1746486 1746490 1746492 1746638 1746640 1746645 1746646 1746650 1746652 1746653 1746654 1746659 1746661 1746664 1748583 1748714 1748715 1749141 1749427 1751879 1751880 1752474 1753271 1753451 1761818 1761819 1761820 1761821 1761822 1761823 1761824 1761825 1761826 1761827 1761828 1761829 1761830 1761832 1761873 1762051 1762052 1762053 1762054 1762055 1762056 1762057 1762058 1762059 1762060 1762061 1762062 1762063 1762064 1762065 1762066 1762067 1762068 1762069 1762070 1762071 1762072 1762073 1762074 1762075 1762076 1762077 1762078 1762079 1762080 1762082 1762088 1762089 1762090 1762091 1762092 1762093 1762094 1762095 1762096 1762097 1762098 1762099 1762100 1762101 1762102 1762103 1762104 1762105 1762106 1762107 1762108 1762109 1762110 1762111 1762112 1762113 1762114 1762115 1762116 1762117 1762118 1762121 1762122 1762123 1764858 1766207 1766208 1766209 1766210 1766211 1766212 1766213 1766214 1766215 1766216 1766217 1766218 1766289 1766290 1766292 1766293 1766294 1766295 1766296 1766297 1766298 1766299 1766300 1766301 1766302 1766303 1772129 1772130 1772131 1772132 1789849 1789850 1790649 1790650 1790651
Blocks: 1735750
TreeView+ depends on / blocked
 
Reported: 2019-08-01 08:00 UTC by Marian Rehak
Modified: 2023-03-24 15:09 UTC (History)
187 users (show)

Fixed In Version: envoy 1.11.1, golang 1.11.13, golang 1.12.8, Nodejs 8.16.1, Nodejs 10.16.3, Nodejs 12.8.1, gRPC-Go 1.21.3, gRPC-Go 1.22.2, gRPC-Go 1.23.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2019-10-17 22:55:25 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:2886 0 None None None 2019-09-23 20:05:04 UTC
Red Hat Product Errata RHBA-2019:3213 0 None None None 2019-10-29 10:14:24 UTC
Red Hat Product Errata RHBA-2019:3289 0 None None None 2019-10-31 17:00:54 UTC
Red Hat Product Errata RHBA-2019:3291 0 None None None 2019-10-31 17:04:52 UTC
Red Hat Product Errata RHSA-2019:2594 0 None None None 2019-09-10 15:59:31 UTC
Red Hat Product Errata RHSA-2019:2661 0 None None None 2019-09-11 05:44:59 UTC
Red Hat Product Errata RHSA-2019:2682 0 None None None 2019-09-09 09:48:10 UTC
Red Hat Product Errata RHSA-2019:2690 0 None None None 2019-09-11 15:28:43 UTC
Red Hat Product Errata RHSA-2019:2726 0 None None None 2019-09-10 13:49:37 UTC
Red Hat Product Errata RHSA-2019:2766 0 None None None 2019-09-12 18:33:07 UTC
Red Hat Product Errata RHSA-2019:2769 0 None None None 2019-10-24 03:07:50 UTC
Red Hat Product Errata RHSA-2019:2796 0 None None None 2019-09-19 02:28:33 UTC
Red Hat Product Errata RHSA-2019:2861 0 None None None 2019-09-26 17:21:38 UTC
Red Hat Product Errata RHSA-2019:2925 0 None None None 2019-09-30 07:21:57 UTC
Red Hat Product Errata RHSA-2019:2939 0 None None None 2019-09-30 23:39:10 UTC
Red Hat Product Errata RHSA-2019:2955 0 None None None 2019-10-02 14:26:51 UTC
Red Hat Product Errata RHSA-2019:2966 0 None None None 2019-10-03 18:57:41 UTC
Red Hat Product Errata RHSA-2019:3131 0 None None None 2019-10-16 15:35:34 UTC
Red Hat Product Errata RHSA-2019:3245 0 None None None 2019-10-29 17:41:51 UTC
Red Hat Product Errata RHSA-2019:3265 0 None None None 2019-10-30 18:18:55 UTC
Red Hat Product Errata RHSA-2019:3892 0 None None None 2019-11-14 21:18:38 UTC
Red Hat Product Errata RHSA-2019:3906 0 None None None 2019-11-18 16:24:49 UTC
Red Hat Product Errata RHSA-2019:4018 0 None None None 2019-11-26 19:55:44 UTC
Red Hat Product Errata RHSA-2019:4019 0 None None None 2019-11-26 20:00:04 UTC
Red Hat Product Errata RHSA-2019:4020 0 None None None 2019-11-26 19:57:16 UTC
Red Hat Product Errata RHSA-2019:4021 0 None None None 2019-11-26 19:58:53 UTC
Red Hat Product Errata RHSA-2019:4040 0 None None None 2019-12-02 17:03:33 UTC
Red Hat Product Errata RHSA-2019:4041 0 None None None 2019-12-02 17:02:58 UTC
Red Hat Product Errata RHSA-2019:4042 0 None None None 2019-12-02 17:03:54 UTC
Red Hat Product Errata RHSA-2019:4045 0 None None None 2019-12-02 17:21:25 UTC
Red Hat Product Errata RHSA-2019:4269 0 None None None 2019-12-17 10:47:30 UTC
Red Hat Product Errata RHSA-2019:4273 0 None None None 2019-12-17 10:48:03 UTC
Red Hat Product Errata RHSA-2019:4352 0 None None None 2019-12-19 17:38:13 UTC
Red Hat Product Errata RHSA-2020:0406 0 None None None 2020-02-04 19:26:51 UTC
Red Hat Product Errata RHSA-2020:0727 0 None None None 2020-03-05 12:54:09 UTC
Red Hat Product Errata RHSA-2020:0922 0 None None None 2020-03-23 08:22:10 UTC
Red Hat Product Errata RHSA-2020:0983 0 None None None 2020-03-26 15:48:08 UTC
Red Hat Product Errata RHSA-2020:1445 0 None None None 2020-04-14 13:05:05 UTC
Red Hat Product Errata RHSA-2020:2067 0 None None None 2020-05-18 10:25:33 UTC
Red Hat Product Errata RHSA-2020:2565 0 None None None 2020-06-15 16:18:08 UTC
Red Hat Product Errata RHSA-2020:3196 0 None None None 2020-07-29 06:07:18 UTC
Red Hat Product Errata RHSA-2020:3197 0 None None None 2020-07-29 06:22:09 UTC

Description Marian Rehak 2019-08-01 08:00:20 UTC 
HTTP/2 flood using PING frames and queueing of response PING ACK frames that results in unbounded memory growth.
Comment 1 Marian Rehak 2019-08-09 07:27:31 UTC 
Acknowledgments:

Name: the Envoy security team
Comment 3 Timothy Walsh 2019-08-15 06:28:08 UTC 
https://istio.io/blog/2019/announcing-1.2.4/
Comment 4 Marian Rehak 2019-08-15 12:54:09 UTC 
Issue in golang:

https://github.com/golang/go/issues/33606
Comment 7 msiddiqu 2019-08-16 07:35:59 UTC 
Created golang tracking bugs for this issue:

Affects: epel-all [bug 1741815]
Affects: fedora-all [bug 1741816]
Comment 9 msiddiqu 2019-08-16 14:30:46 UTC 
Created nodejs tracking bugs for this issue:

Affects: epel-all [bug 1741989]
Affects: fedora-all [bug 1741988]
Comment 10 msiddiqu 2019-08-16 14:38:19 UTC 
Created nodejs tracking bugs for this issue:

Affects: epel-all [bug 1741997]
Affects: fedora-all [bug 1741996]
Comment 11 msiddiqu 2019-08-16 18:14:43 UTC 
Created nginx tracking bugs for this issue:

Affects: epel-all [bug 1742247]
Affects: fedora-all [bug 1742245]
Comment 22 Marco Benatto 2019-08-21 18:53:37 UTC 
NodeJS upstream commit:
https://github.com/nodejs/node/commit/fd148d38d259fee8507cdb5c57dda82e1d1a4819
Comment 29 msiddiqu 2019-08-26 12:55:02 UTC 
Created kubernetes tracking bugs for this issue:

Affects: fedora-all [bug 1745594]
Comment 33 Marco Benatto 2019-08-26 16:41:45 UTC 
golang has a bundled HTTP/2 implementation. Upstream commit containing the fix backport:
https://github.com/golang/go/commit/e152b01a468a1c18a290bf9aec52ccea7693c7f2
Comment 34 Hardik Vyas 2019-08-27 13:09:39 UTC 
All golang upstream patches:

net/http/
https://github.com/golang/go/commit/e152b01a468a1c18a290bf9aec52ccea7693c7f2  [1.11]
https://github.com/golang/go/commit/7139b45d1410ded14e1e131151fd8dfc435ede6c  [1.12]

x/net/http2 
https://github.com/golang/net/commit/b1cc14aba47abf96f96818003fa4caad3a4b4e86 [1.11]
https://github.com/golang/net/commit/cdfb69ac37fc6fa907650654115ebebb3aae2087 [1.12]
Comment 44 Sam Fowler 2019-08-29 04:16:55 UTC 
External References:

https://groups.google.com/forum/#!topic/golang-announce/65QixT3tcmg
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wlHLHit1BqA
https://www.mail-archive.com/grpc-io@googlegroups.com/msg06408.html
Comment 66 Marco Benatto 2019-09-03 21:33:41 UTC 
Created undertow tracking bugs for this issue:

Affects: fedora-all [bug 1748583]
Comment 72 errata-xmlrpc 2019-09-09 09:48:06 UTC 
This issue has been addressed in the following products:

  Red Hat Developer Tools

Via RHSA-2019:2682 https://access.redhat.com/errata/RHSA-2019:2682
Comment 74 errata-xmlrpc 2019-09-10 13:49:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:2726 https://access.redhat.com/errata/RHSA-2019:2726
Comment 75 errata-xmlrpc 2019-09-10 15:59:26 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2019:2594 https://access.redhat.com/errata/RHSA-2019:2594
Comment 76 Product Security DevOps Team 2019-09-10 18:45:32 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-9512
Comment 77 errata-xmlrpc 2019-09-11 05:44:54 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2019:2661 https://access.redhat.com/errata/RHSA-2019:2661
Comment 78 errata-xmlrpc 2019-09-11 15:28:39 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.10

Via RHSA-2019:2690 https://access.redhat.com/errata/RHSA-2019:2690
Comment 80 errata-xmlrpc 2019-09-12 18:33:03 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2019:2766 https://access.redhat.com/errata/RHSA-2019:2766
Comment 84 errata-xmlrpc 2019-09-19 02:28:27 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 14.0 (Rocky)

Via RHSA-2019:2796 https://access.redhat.com/errata/RHSA-2019:2796
Comment 88 errata-xmlrpc 2019-09-26 17:21:32 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2019:2861 https://access.redhat.com/errata/RHSA-2019:2861
Comment 89 errata-xmlrpc 2019-09-30 07:21:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:2925 https://access.redhat.com/errata/RHSA-2019:2925
Comment 90 errata-xmlrpc 2019-09-30 23:39:05 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2019:2939 https://access.redhat.com/errata/RHSA-2019:2939
Comment 92 errata-xmlrpc 2019-10-02 14:26:46 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2019:2955 https://access.redhat.com/errata/RHSA-2019:2955
Comment 93 errata-xmlrpc 2019-10-03 18:57:36 UTC 
This issue has been addressed in the following products:

  Red Hat Quay 3

Via RHSA-2019:2966 https://access.redhat.com/errata/RHSA-2019:2966
Comment 94 Sam Fowler 2019-10-08 05:42:41 UTC 
Statement:

The golang package in Red Hat OpenStack Platform 9 Operational Tools will not be updated for this flaw because it is in technical preview and is retiring as of 24.Aug.2019.
This issue did not affect the versions of grafana(embeds golang) as shipped with Red Hat Ceph Storage 2 and Red Hat Gluster Storage 3 as they did not include the support for HTTP/2.
The following storage product versions are affected because they include the support for HTTP/2 in:
* golang as shipped with Red Hat Gluster Storage 3, Red Hat Ceph Storage 2 and Red Hat Ceph Storage 3
* heketi(embeds golang) as shipped with Red Hat Gluster Storage 3
* grafana(embeds golang and grpc) as shipped with Red Hat Ceph Storage 3
This flaw has no available mitigation for packages golang and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.

The nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.

All OpenShift Container Platform RPMs and container images that are built with Go and support HTTP/2 are vulnerable to this flaw.
Comment 102 errata-xmlrpc 2019-10-16 15:35:27 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2019:3131 https://access.redhat.com/errata/RHSA-2019:3131
Comment 106 errata-xmlrpc 2019-10-24 03:07:44 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.9

Via RHSA-2019:2769 https://access.redhat.com/errata/RHSA-2019:2769
Comment 114 errata-xmlrpc 2019-10-29 17:41:45 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.2

Via RHSA-2019:3245 https://access.redhat.com/errata/RHSA-2019:3245
Comment 115 errata-xmlrpc 2019-10-30 18:18:43 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2019:3265 https://access.redhat.com/errata/RHSA-2019:3265
Comment 121 errata-xmlrpc 2019-11-14 21:18:33 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.5.0

Via RHSA-2019:3892 https://access.redhat.com/errata/RHSA-2019:3892
Comment 122 errata-xmlrpc 2019-11-18 16:24:44 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.11

Via RHSA-2019:3906 https://access.redhat.com/errata/RHSA-2019:3906
Comment 126 errata-xmlrpc 2019-11-26 19:55:39 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

Via RHSA-2019:4018 https://access.redhat.com/errata/RHSA-2019:4018
Comment 127 errata-xmlrpc 2019-11-26 19:57:11 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8

Via RHSA-2019:4020 https://access.redhat.com/errata/RHSA-2019:4020
Comment 128 errata-xmlrpc 2019-11-26 19:58:48 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2019:4021 https://access.redhat.com/errata/RHSA-2019:4021
Comment 129 errata-xmlrpc 2019-11-26 19:59:59 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

Via RHSA-2019:4019 https://access.redhat.com/errata/RHSA-2019:4019
Comment 130 errata-xmlrpc 2019-12-02 17:02:52 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3 for RHEL 7

Via RHSA-2019:4041 https://access.redhat.com/errata/RHSA-2019:4041
Comment 131 errata-xmlrpc 2019-12-02 17:03:27 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3 for RHEL 6

Via RHSA-2019:4040 https://access.redhat.com/errata/RHSA-2019:4040
Comment 132 errata-xmlrpc 2019-12-02 17:03:48 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3 for RHEL 8

Via RHSA-2019:4042 https://access.redhat.com/errata/RHSA-2019:4042
Comment 133 errata-xmlrpc 2019-12-02 17:21:19 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On

Via RHSA-2019:4045 https://access.redhat.com/errata/RHSA-2019:4045
Comment 138 errata-xmlrpc 2019-12-17 10:47:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:4269 https://access.redhat.com/errata/RHSA-2019:4269
Comment 139 errata-xmlrpc 2019-12-17 10:47:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:4273 https://access.redhat.com/errata/RHSA-2019:4273
Comment 141 errata-xmlrpc 2019-12-19 17:38:07 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 6.3

Via RHSA-2019:4352 https://access.redhat.com/errata/RHSA-2019:4352
Comment 145 errata-xmlrpc 2020-02-04 19:26:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extras

Via RHSA-2020:0406 https://access.redhat.com/errata/RHSA-2020:0406
Comment 148 errata-xmlrpc 2020-03-05 12:54:02 UTC 
This issue has been addressed in the following products:

  Red Hat Data Grid 7.3.3

Via RHSA-2020:0727 https://access.redhat.com/errata/RHSA-2020:0727
Comment 151 errata-xmlrpc 2020-03-23 08:21:51 UTC 
This issue has been addressed in the following products:

  Red Hat AMQ

Via RHSA-2020:0922 https://access.redhat.com/errata/RHSA-2020:0922
Comment 154 errata-xmlrpc 2020-03-26 15:47:57 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.6.0

Via RHSA-2020:0983 https://access.redhat.com/errata/RHSA-2020:0983
Comment 155 errata-xmlrpc 2020-04-14 13:04:58 UTC 
This issue has been addressed in the following products:

  Red Hat AMQ 7.4.3

Via RHSA-2020:1445 https://access.redhat.com/errata/RHSA-2020:1445
Comment 158 errata-xmlrpc 2020-05-18 10:25:19 UTC 
This issue has been addressed in the following products:

  Red Hat Openshift Application Runtimes

Via RHSA-2020:2067 https://access.redhat.com/errata/RHSA-2020:2067
Comment 159 errata-xmlrpc 2020-06-15 16:18:01 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:2565 https://access.redhat.com/errata/RHSA-2020:2565
Comment 160 errata-xmlrpc 2020-07-29 06:07:11 UTC 
This issue has been addressed in the following products:

  Red Hat Decision Manager

Via RHSA-2020:3196 https://access.redhat.com/errata/RHSA-2020:3196
Comment 161 errata-xmlrpc 2020-07-29 06:22:01 UTC 
This issue has been addressed in the following products:

  Red Hat Process Automation

Via RHSA-2020:3197 https://access.redhat.com/errata/RHSA-2020:3197
Note You need to log in before you can comment on or make changes to this bug.