Bug 1735749 (CVE-2019-9518) - CVE-2019-9518 HTTP/2: flood using empty frames results in excessive resource consumption
Summary: CVE-2019-9518 HTTP/2: flood using empty frames results in excessive resource ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-9518
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1741969 1741973 1742360 1742363 1744768 1744770 1744771 1744772 1744773 1744774 1748605
Blocks: 1735750
TreeView+ depends on / blocked
 
Reported: 2019-08-01 11:49 UTC by Marian Rehak
Modified: 2023-03-24 15:09 UTC (History)
113 users (show)

Fixed In Version: envoy 1.11.1, Nodejs 8.16.1, Nodejs 10.16.3, Nodejs 12.8.1, undertow 2.0.26.SP2, undertow 2.0.27.Final
Clone Of:
Environment:
Last Closed: 2019-09-30 18:45:42 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:3289 0 None None None 2019-10-31 17:01:10 UTC
Red Hat Product Errata RHBA-2019:3291 0 None None None 2019-10-31 17:05:06 UTC
Red Hat Product Errata RHSA-2019:2925 0 None None None 2019-09-30 07:22:07 UTC
Red Hat Product Errata RHSA-2019:2939 0 None None None 2019-09-30 23:39:20 UTC
Red Hat Product Errata RHSA-2019:2955 0 None None None 2019-10-02 14:27:02 UTC
Red Hat Product Errata RHSA-2019:3892 0 None None None 2019-11-14 21:18:49 UTC
Red Hat Product Errata RHSA-2019:4352 0 None None None 2019-12-19 17:38:25 UTC
Red Hat Product Errata RHSA-2020:0727 0 None None None 2020-03-05 12:54:24 UTC
Red Hat Product Errata RHSA-2020:0922 0 None None None 2020-03-23 08:22:40 UTC
Red Hat Product Errata RHSA-2020:0983 0 None None None 2020-03-26 15:48:27 UTC
Red Hat Product Errata RHSA-2020:1445 0 None None None 2020-04-14 13:05:18 UTC
Red Hat Product Errata RHSA-2020:3196 0 None None None 2020-07-29 06:07:32 UTC
Red Hat Product Errata RHSA-2020:3197 0 None None None 2020-07-29 06:22:22 UTC

Description Marian Rehak 2019-08-01 11:49:08 UTC
HTTP/2 flood using frames with an empty payload that results in excessive CPU usage and starvation of other clients.

Comment 1 Marian Rehak 2019-08-09 07:28:07 UTC
Acknowledgments:

Name: the Envoy security team

Comment 3 Timothy Walsh 2019-08-15 06:31:35 UTC
https://istio.io/blog/2019/announcing-1.2.4/

Comment 6 msiddiqu 2019-08-16 14:21:48 UTC
Created nodejs tracking bugs for this issue:

Affects: epel-all [bug 1741973]
Affects: fedora-all [bug 1741969]

Comment 8 msiddiqu 2019-08-16 18:36:40 UTC
Created nginx tracking bugs for this issue:

Affects: epel-all [bug 1742363]
Affects: fedora-all [bug 1742360]

Comment 12 Marco Benatto 2019-08-22 20:49:21 UTC
NodeJS upstream commit for this issue:
https://github.com/nodejs/node/commit/17357d37a9

Comment 17 Marco Benatto 2019-09-03 21:37:53 UTC
Created undertow tracking bugs for this issue:

Affects: fedora-all [bug 1748605]

Comment 18 Sam Fowler 2019-09-04 07:07:05 UTC
Statement:

This flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.

The nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.

Comment 23 errata-xmlrpc 2019-09-30 07:22:03 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:2925 https://access.redhat.com/errata/RHSA-2019:2925

Comment 24 Product Security DevOps Team 2019-09-30 18:45:42 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-9518

Comment 25 errata-xmlrpc 2019-09-30 23:39:17 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2019:2939 https://access.redhat.com/errata/RHSA-2019:2939

Comment 28 errata-xmlrpc 2019-10-02 14:26:58 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2019:2955 https://access.redhat.com/errata/RHSA-2019:2955

Comment 33 errata-xmlrpc 2019-11-14 21:18:45 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 7.5.0

Via RHSA-2019:3892 https://access.redhat.com/errata/RHSA-2019:3892

Comment 34 Paramvir jindal 2019-11-19 10:39:28 UTC
RHSSO undertow is not affected but RHSSO netty component seems to be affected by this as per:
https://netty.io/news/2019/08/13/4-1-39-Final.html

Comment 41 errata-xmlrpc 2019-12-19 17:38:21 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 6.3

Via RHSA-2019:4352 https://access.redhat.com/errata/RHSA-2019:4352

Comment 44 errata-xmlrpc 2020-03-05 12:54:20 UTC
This issue has been addressed in the following products:

  Red Hat Data Grid 7.3.3

Via RHSA-2020:0727 https://access.redhat.com/errata/RHSA-2020:0727

Comment 45 errata-xmlrpc 2020-03-23 08:22:30 UTC
This issue has been addressed in the following products:

  Red Hat AMQ

Via RHSA-2020:0922 https://access.redhat.com/errata/RHSA-2020:0922

Comment 46 errata-xmlrpc 2020-03-26 15:48:21 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 7.6.0

Via RHSA-2020:0983 https://access.redhat.com/errata/RHSA-2020:0983

Comment 48 errata-xmlrpc 2020-04-14 13:05:13 UTC
This issue has been addressed in the following products:

  Red Hat AMQ 7.4.3

Via RHSA-2020:1445 https://access.redhat.com/errata/RHSA-2020:1445

Comment 50 errata-xmlrpc 2020-07-29 06:07:28 UTC
This issue has been addressed in the following products:

  Red Hat Decision Manager

Via RHSA-2020:3196 https://access.redhat.com/errata/RHSA-2020:3196

Comment 51 errata-xmlrpc 2020-07-29 06:22:18 UTC
This issue has been addressed in the following products:

  Red Hat Process Automation

Via RHSA-2020:3197 https://access.redhat.com/errata/RHSA-2020:3197

Comment 52 Jonathan Christison 2021-01-26 12:39:03 UTC
Marking EAP 7 as being affected but at a low impact, although some artifacts are shipped that contain what we have determined as being vulnerable code but the use of these artifacts in EAP does not expose the vulnerable behaviour i.e. does not result in excessive CPU usage and will not result in a DoS.


Note You need to log in before you can comment on or make changes to this bug.