Bug 1735745 (CVE-2019-9515) - CVE-2019-9515 HTTP/2: flood using SETTINGS frames results in unbounded memory growth
Summary: CVE-2019-9515 HTTP/2: flood using SETTINGS frames results in unbounded memory...
Alias: CVE-2019-9515
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Whiteboard: impact=moderate,public=20190813:1700,...
Depends On: 1742059 1742333 1744742 1744744 1744745 1744746 1744747 1744748 1746645 1746646 1746650 1746652 1746653 1746661 1746901 1748604 1748719 1749427 1751879 1751880 1742058 1742332 1746654 1746659 1746664 1748720
Blocks: 1735750
TreeView+ depends on / blocked
Reported: 2019-08-01 11:46 UTC by Marian Rehak
Modified: 2019-09-12 20:29 UTC (History)
122 users (show)

Fixed In Version: envoy 1.11.1, Nodejs 8.16.1, Nodejs 10.16.3, Nodejs 12.8.1, gRPC-Go 1.21.3, gRPC-Go 1.22.2, gRPC-Go 1.23.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2019-09-12 18:45:32 UTC

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:2766 None None None 2019-09-12 18:33:08 UTC

Description Marian Rehak 2019-08-01 11:46:02 UTC
HTTP/2 flood using SETTINGS frames and queueing of SETTINGS ACK frames that results in unbounded memory growth.

Comment 1 Marian Rehak 2019-08-09 07:28:01 UTC

Name: the Envoy security team

Comment 3 Timothy Walsh 2019-08-15 06:30:48 UTC

Comment 7 msiddiqu 2019-08-16 18:29:45 UTC
Created nginx tracking bugs for this issue:

Affects: epel-all [bug 1742333]
Affects: fedora-all [bug 1742332]

Comment 38 Marco Benatto 2019-09-03 21:37:15 UTC
Created undertow tracking bugs for this issue:

Affects: fedora-all [bug 1748604]

Comment 40 Sam Fowler 2019-09-04 07:06:56 UTC

This issue affects the version of grafana(embeds gRPC) as shipped with Red Hat Ceph Storage 3 as it include the support for HTTP/2.
This flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.

The nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.

Comment 41 Marian Rehak 2019-09-05 10:27:37 UTC
tracker for fedora-all nginx closed

Comment 44 errata-xmlrpc 2019-09-12 18:33:04 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2019:2766 https://access.redhat.com/errata/RHSA-2019:2766

Comment 45 Product Security DevOps Team 2019-09-12 18:45:32 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Note You need to log in before you can comment on or make changes to this bug.