Details of VAR-201908-0421

ID

VAR-201908-0421

CVE

CVE-2019-9511

TITLE

HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion

Trust: 0.8

sources: CERT/CC: VU#605641

DESCRIPTION

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. Multiple HTTP/2 implementations are vulnerable to a variety of denial-of-service (DoS) attacks. HTTP/2 is the second version of the hypertext transfer protocol, which is mainly used to ensure the communication between the client and the server. A resource management error vulnerability exists in HTTP/2. A vulnerability in the HTTP/2 implementation of Nginx could allow an authenticated, remote malicious user to cause a denial of service (DoS) condition on a targeted system. The vulnerability is due to improper window manipulation in the affected software that could lead to excessive CPU usage. An attacker could exploit this vulnerability by manipulating window sizes on affected system. A successful exploit could result in a DoS condition on the targeted system. nginx.org has confirmed the vulnerability and released software updates. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: rh-nginx114-nginx security update Advisory ID: RHSA-2019:2775-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2019:2775 Issue date: 2019-09-16 CVE Names: CVE-2019-9511 CVE-2019-9513 CVE-2019-9516 ==================================================================== 1. Summary: An update for rh-nginx114-nginx is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - aarch64, ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) - ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) - ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) - ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) - ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511) * HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513) * HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The rh-nginx114-nginx service must be restarted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1735741 - CVE-2019-9513 HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption 1741860 - CVE-2019-9511 HTTP/2: large amount of data requests leads to denial of service 1741864 - CVE-2019-9516 HTTP/2: 0-length headers lead to denial of service 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-nginx114-nginx-1.14.1-1.el7.1.src.rpm aarch64: rh-nginx114-nginx-1.14.1-1.el7.1.aarch64.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.aarch64.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.aarch64.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.aarch64.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.aarch64.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.aarch64.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.aarch64.rpm ppc64le: rh-nginx114-nginx-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.ppc64le.rpm s390x: rh-nginx114-nginx-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.s390x.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-nginx114-nginx-1.14.1-1.el7.1.src.rpm aarch64: rh-nginx114-nginx-1.14.1-1.el7.1.aarch64.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.aarch64.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.aarch64.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.aarch64.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.aarch64.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.aarch64.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.aarch64.rpm ppc64le: rh-nginx114-nginx-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.ppc64le.rpm s390x: rh-nginx114-nginx-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.s390x.rpm x86_64: rh-nginx114-nginx-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4): Source: rh-nginx114-nginx-1.14.1-1.el7.1.src.rpm ppc64le: rh-nginx114-nginx-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.ppc64le.rpm s390x: rh-nginx114-nginx-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.s390x.rpm x86_64: rh-nginx114-nginx-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5): Source: rh-nginx114-nginx-1.14.1-1.el7.1.src.rpm ppc64le: rh-nginx114-nginx-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.ppc64le.rpm s390x: rh-nginx114-nginx-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.s390x.rpm x86_64: rh-nginx114-nginx-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6): Source: rh-nginx114-nginx-1.14.1-1.el7.1.src.rpm ppc64le: rh-nginx114-nginx-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.ppc64le.rpm s390x: rh-nginx114-nginx-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.s390x.rpm x86_64: rh-nginx114-nginx-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7): Source: rh-nginx114-nginx-1.14.1-1.el7.1.src.rpm ppc64le: rh-nginx114-nginx-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.ppc64le.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.ppc64le.rpm s390x: rh-nginx114-nginx-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.s390x.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.s390x.rpm x86_64: rh-nginx114-nginx-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-nginx114-nginx-1.14.1-1.el7.1.src.rpm x86_64: rh-nginx114-nginx-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-debuginfo-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-image-filter-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-perl-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-http-xslt-filter-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-mail-1.14.1-1.el7.1.x86_64.rpm rh-nginx114-nginx-mod-stream-1.14.1-1.el7.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-9511 https://access.redhat.com/security/cve/CVE-2019-9513 https://access.redhat.com/security/cve/CVE-2019-9516 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXYD0u9zjgjWX9erEAQh90w/7BWdh3Jxs9cP+P0kgwkv3Y0BLGblHx0B4 3BkFoa4B+/k2xrCOl+vy6cPip7PY7KVemOfv6g3BYlqAISOxU2lSjScEMwhdrh4g 2Ng7xkoUOoQ0KfXmVzMayVUkRwgam+utdacHnNgdGdYPwhCmticW0n5PfNakMOb6 CCmUZ91tfV7orMPiH+f1nBIulXok4zcOzdvZElSh97dmQcjoi+T5EoqbcFY8n5Ck Y+COohJ3X026oab73Tr2Kayju43TJGUdNR8lVmap4H8QkXqvbTrjd2YqXj8Zg7qr oNh7J2jnRec01+rYG8sL225+ZrdTtZ6c7kXQpUDh+jkjDImfJZz38HkI5/mRU+iS VSqP5PAhKvYlOXvIGIOoWtMXLDmnuzVEo/E/tScHc85Mp+6B5yM5r93dTGuRfjo1 yvSIftS3y7A8NtP7oJvpvVhcVAyc024X124PtojSoL+s5K60jzy06rky4WxIy0uh kqK1W/SowueKFreJjBo4N6ZZ6rjBZ8okZKqWjRCi56szhP3KJ4+563g5VfltLsd5 YqN9li8tUNzjrehVkZKEKfv6RkEQUuAbyAEVL6yFzVk3lTf1SgjlQhCNedWmD6N7 aeVU/tMNw4gMXXtmLPObL54HNUNgM799BLVzzna+wofr2iT7nnUZakCsfn+jHYk7 3Z3oFnpnL5o=L5z9 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . The following advisory data is extracted from: https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_5856.json Red Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment. Description: Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. See the Red Hat JBoss Enterprise Application Platform 7.2.5 Release Notes for information about the most significant bug fixes and enhancements included in this release. Solution: Before applying this update, ensure all previously released errata relevant to your system have been applied. JIRA issues fixed (https://issues.jboss.org/): JBEAP-17075 - (7.2.z) Upgrade yasson from 1.0.2.redhat-00001 to 1.0.5 JBEAP-17220 - (7.2.x) HHH-13504 Upgrade ByteBuddy to 1.9.11 JBEAP-17365 - [GSS](7.2.z) Upgrade RESTEasy from 3.6.1.SP6 to 3.6.1.SP7 JBEAP-17476 - [GSS](7.2.z) Upgrade Generic JMS RA 2.0.2.Final JBEAP-17478 - [GSS](7.2.z) Upgrade JBoss Remoting from 5.0.14.SP1 to 5.0.16.Final JBEAP-17483 - [GSS](7.2.z) Upgrade Apache CXF from 3.2.9 to 3.2.10 JBEAP-17495 - (7.2.z) Upgrade PicketLink from 2.5.5.SP12-redhat-00007 to 2.5.5.SP12-redhat-00009 JBEAP-17496 - (7.2.z) Upgrade PicketLink bindings from 2.5.5.SP12-redhat-00007 to 2.5.5.SP12-redhat-00009 JBEAP-17513 - [GSS](7.2.z) Upgrade Hibernate ORM from 5.3.11.SP1 to 5.3.13 JBEAP-17521 - (7.2.z) Upgrade picketbox from 5.0.3.Final-redhat-00004 to 5.0.3.Final-redhat-00005 JBEAP-17523 - [GSS](7.2.z) Upgrade wildfly-core from 6.0.16 to 6.0.17 JBEAP-17547 - [GSS](7.2.z) Upgrade Elytron-Tool from 1.4.3 to 1.4.4.Final JBEAP-17548 - [GSS](7.2.z) Upgrade Elytron from 1.6.4.Final-redhat-00001 to 1.6.5.Final-redhat-00001 JBEAP-17560 - [GSS](7.2.z) Upgrade HAL from 3.0.16 to 3.0.17 JBEAP-17579 - [GSS](7.2.z) Upgrade JBoss MSC from 1.4.8 to 1.4.11 JBEAP-17582 - [GSS](7.2.z) Upgrade JSF based on Mojarra 2.3.5.SP3-redhat-00002 to 2.3.5.SP3-redhat-00003 JBEAP-17605 - Tracker bug for the EAP 7.2.5 release for RHEL-8 JBEAP-17631 - [GSS](7.2.z) Upgrade Undertow from 2.0.25.SP1 to 2.0.26.SP3 JBEAP-17647 - [GSS](7.2.z) Upgrade IronJacamar from 1.4.17.Final to 1.4.18.Final JBEAP-17665 - [GSS](7.2.z) Upgrade XNIO from 3.7.3.Final-redhat-00001 to 3.7.6.Final JBEAP-17722 - [GSS](7.2.z) Upgrade wildfly-http-client from 1.0.15.Final-redhat-00001 to 1.0.17.Final JBEAP-17874 - (7.2.z) Upgrade to wildfly-openssl 1.0.8 JBEAP-17880 - (7.2.z) Upgrade XNIO from 3.7.6.Final-redhat-00001 to 3.7.6.SP1 7. For the oldstable distribution (stretch), these problems have been fixed in version 1.10.3-1+deb9u3. For the stable distribution (buster), these problems have been fixed in version 1.14.2-2+deb10u1. We recommend that you upgrade your nginx packages. For the detailed security status of nginx please refer to its security tracker page at: https://security-tracker.debian.org/tracker/nginx Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl1e7q4ACgkQEMKTtsN8 TjanPg/+JLLuKVdUDpVPFNkX1ckmT5gsoCwzGz3ybhcDMxbf7jD8jtmXFiGFn4fP MXsx6MgrRZn3hq+2VF6MKZjKh9n1hBX38PkqjHKEtV6Xzor97xxLH0rrMlBMEQ7y rz96YTffJfcj+ykI3Vlye1GGDEiKyu0vWgoutXH3i8GUYFyDk//HQdI0eJLQhkfo TMRdbAKmMGeMt/8tSz4G0wewdxc9xjNwE1lKkV22JbT6t656f5QtvOLxt2HvM5c4 gFtFFBv7e1ymh0CKz4VxOxjEH+4ogx5HfzcYP2LjaZJsCFOw8ZUbdieFhlF0R2jH vskBuYLPa/djYHoZ55KY/WTmTsn72y7ZEuQcAdiHRVjg6wRFaum/KkdwutBBCeEj odvrGUcgdLLx4uAC7JOt9HME77Rgu1wTnx3l9L3QCwxIXpHqL8zOuSrSKYDuntDT agQ/awapEYYK5IAgo7YGkhHHHbTSLQ2UX9KfmyoPXJ+H9Vl/XjGhPwdDSEYNqrE9 IKQ8gaFCVOgjJo8lTa5NBsvxa08Gh6jQGZo8Rgfjs4KvUS847Cpb086BvU9pMs36 46+cLbkJ2jkfMLd4slZ5Gf2wkagUJmeZD5O7bY90Szs/IUOJez0LWaN3l7VSMtvY a3a/Y53cX1QYt60eiE6x/ifraOHzcsJglrUNmK8VPfJ9tSTFhWY=+ZOE -----END PGP SIGNATURE----- . 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms. For further information, refer to the release notes linked to in the References section. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update)

Trust: 2.61

sources: NVD: CVE-2019-9511 // CERT/CC: VU#605641 // VULHUB: VHN-160946 // VULMON: CVE-2019-9511 // PACKETSTORM: 168812 // PACKETSTORM: 154510 // PACKETSTORM: 180394 // PACKETSTORM: 155479 // PACKETSTORM: 154190 // PACKETSTORM: 157214 // PACKETSTORM: 154533 // PACKETSTORM: 154284 // PACKETSTORM: 156852

AFFECTED PRODUCTS

vendor:	redhat	model:	software collections	scope:	eq	version:	1.0	Trust: 1.0
vendor:	fedoraproject	model:	fedora	scope:	eq	version:	30	Trust: 1.0
vendor:	apache	model:	traffic server	scope:	lte	version:	8.0.3	Trust: 1.0
vendor:	debian	model:	linux	scope:	eq	version:	9.0	Trust: 1.0
vendor:	redhat	model:	quay	scope:	eq	version:	3.0.0	Trust: 1.0
vendor:	canonical	model:	ubuntu linux	scope:	eq	version:	16.04	Trust: 1.0
vendor:	mcafee	model:	web gateway	scope:	lt	version:	7.7.2.24	Trust: 1.0
vendor:	canonical	model:	ubuntu linux	scope:	eq	version:	19.04	Trust: 1.0
vendor:	redhat	model:	openshift service mesh	scope:	eq	version:	1.0	Trust: 1.0
vendor:	apache	model:	traffic server	scope:	gte	version:	6.0.0	Trust: 1.0
vendor:	f5	model:	nginx	scope:	lte	version:	1.17.2	Trust: 1.0
vendor:	apache	model:	traffic server	scope:	gte	version:	8.0.0	Trust: 1.0
vendor:	f5	model:	nginx	scope:	gte	version:	1.17.0	Trust: 1.0
vendor:	oracle	model:	graalvm	scope:	eq	version:	19.2.0	Trust: 1.0
vendor:	oracle	model:	enterprise communications broker	scope:	eq	version:	3.2.0	Trust: 1.0
vendor:	synology	model:	diskstation manager	scope:	eq	version:	6.2	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	lte	version:	10.12.0	Trust: 1.0
vendor:	f5	model:	nginx	scope:	lt	version:	1.16.1	Trust: 1.0
vendor:	apple	model:	swiftnio	scope:	gte	version:	1.0.0	Trust: 1.0
vendor:	oracle	model:	enterprise communications broker	scope:	eq	version:	3.1.0	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	gte	version:	10.0.0	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	lt	version:	10.16.3	Trust: 1.0
vendor:	mcafee	model:	web gateway	scope:	gte	version:	7.7.2.0	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	gte	version:	8.9.0	Trust: 1.0
vendor:	canonical	model:	ubuntu linux	scope:	eq	version:	18.04	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	lt	version:	8.16.1	Trust: 1.0
vendor:	synology	model:	vs960hd	scope:	eq	version:	-	Trust: 1.0
vendor:	mcafee	model:	web gateway	scope:	gte	version:	8.1.0	Trust: 1.0
vendor:	apache	model:	traffic server	scope:	gte	version:	7.0.0	Trust: 1.0
vendor:	mcafee	model:	web gateway	scope:	lt	version:	8.2.0	Trust: 1.0
vendor:	f5	model:	nginx	scope:	gte	version:	1.9.5	Trust: 1.0
vendor:	opensuse	model:	leap	scope:	eq	version:	15.1	Trust: 1.0
vendor:	mcafee	model:	web gateway	scope:	gte	version:	7.8.2.0	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	lte	version:	8.8.1	Trust: 1.0
vendor:	fedoraproject	model:	fedora	scope:	eq	version:	29	Trust: 1.0
vendor:	opensuse	model:	leap	scope:	eq	version:	15.0	Trust: 1.0
vendor:	apache	model:	traffic server	scope:	lte	version:	6.2.3	Trust: 1.0
vendor:	redhat	model:	jboss core services	scope:	eq	version:	1.0	Trust: 1.0
vendor:	synology	model:	skynas	scope:	eq	version:	-	Trust: 1.0
vendor:	redhat	model:	jboss enterprise application platform	scope:	eq	version:	7.3.0	Trust: 1.0
vendor:	redhat	model:	enterprise linux	scope:	eq	version:	8.0	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	gte	version:	8.0.0	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	gte	version:	10.13.0	Trust: 1.0
vendor:	apple	model:	swiftnio	scope:	lte	version:	1.4.0	Trust: 1.0
vendor:	mcafee	model:	web gateway	scope:	lt	version:	7.8.2.13	Trust: 1.0
vendor:	debian	model:	linux	scope:	eq	version:	10.0	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	lt	version:	12.8.1	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	gte	version:	12.0.0	Trust: 1.0
vendor:	apache	model:	traffic server	scope:	lte	version:	7.1.6	Trust: 1.0
vendor:	redhat	model:	jboss enterprise application platform	scope:	eq	version:	7.2.0	Trust: 1.0
vendor:	akamai	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	amazon	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	apache traffic server	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	apple	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	cloudflare	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	envoy	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	facebook	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	go programming language	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	litespeed	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	microsoft	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	netty	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	node js	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	synology	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	twisted	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	ubuntu	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	grpc	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	nghttp2	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	nginx	model:	-	scope:	-	version:	-	Trust: 0.8

sources: CERT/CC: VU#605641 // NVD: CVE-2019-9511

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-9511
value:	HIGH
Trust: 1.0
cret@cert.org:	CVE-2019-9511
value:	HIGH
Trust: 1.0
VULHUB:	VHN-160946
value:	HIGH
Trust: 0.1
VULMON:	CVE-2019-9511
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-9511
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
VULHUB:	VHN-160946
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-9511
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
cret@cert.org:	CVE-2019-9511
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 1.0

sources: VULHUB: VHN-160946 // VULMON: CVE-2019-9511 // NVD: CVE-2019-9511 // NVD: CVE-2019-9511

PROBLEMTYPE DATA

problemtype:	CWE-400	Trust: 1.1
problemtype:	CWE-770	Trust: 1.1

sources: VULHUB: VHN-160946 // NVD: CVE-2019-9511

THREAT TYPE

remote

Trust: 0.1

sources: PACKETSTORM: 180394

TYPE

xss

Trust: 0.2

sources: PACKETSTORM: 157214 // PACKETSTORM: 156852

PATCH

title:	Red Hat: Important: nghttp2 security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20192692 - Security Advisory	Trust: 0.1
title:	Red Hat: Important: Red Hat OpenShift Service Mesh 1.0.1 RPMs	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20193041 - Security Advisory	Trust: 0.1
title:	Red Hat: Important: rh-nginx110-nginx security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20192745 - Security Advisory	Trust: 0.1
title:	Red Hat: Important: rh-nginx114-nginx security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20192775 - Security Advisory	Trust: 0.1
title:	Red Hat: Important: httpd24-httpd and httpd24-nghttp2 security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20192949 - Security Advisory	Trust: 0.1
title:	Red Hat: Important: nginx:1.14 security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20192799 - Security Advisory	Trust: 0.1
title:	Red Hat: Important: rh-nginx112-nginx security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20192746 - Security Advisory	Trust: 0.1
title:	Debian Security Advisories: DSA-4511-1 nghttp2 -- security update	url:	https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=5abd31eeab4f550ac0063c6db4c6fefa	Trust: 0.1
title:	Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.2.5 security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20194021 - Security Advisory	Trust: 0.1
title:	Ubuntu Security Notice: nginx vulnerabilities	url:	https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-4099-1	Trust: 0.1
title:	Red Hat: CVE-2019-9511	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2019-9511	Trust: 0.1
title:	Red Hat: Important: Red Hat Quay v3.1.1 security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20192966 - Security Advisory	Trust: 0.1
title:	Debian CVElist Bug Report Logs: nginx: CVE-2019-9511 CVE-2019-9513 CVE-2019-9516	url:	https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=aa3f98e7e42f366cb232cf3ada195106	Trust: 0.1
title:	Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 6 security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20194018 - Security Advisory	Trust: 0.1
title:	Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 8 security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20194020 - Security Advisory	Trust: 0.1
title:	Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 7 security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20194019 - Security Advisory	Trust: 0.1
title:	Red Hat: Important: nodejs:10 security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20192925 - Security Advisory	Trust: 0.1
title:	Arch Linux Issues:	url:	https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues&qid=CVE-2019-9511	Trust: 0.1
title:	Debian Security Advisories: DSA-4505-1 nginx -- security update	url:	https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=b38c3ef2fccf5f32d01340c117d4ef05	Trust: 0.1
title:	Amazon Linux AMI: ALAS-2019-1298	url:	https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2019-1298	Trust: 0.1
title:	Red Hat: Important: rh-nodejs8-nodejs security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20192955 - Security Advisory	Trust: 0.1
title:	Arch Linux Advisories: [ASA-201908-13] nginx: denial of service	url:	https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-201908-13	Trust: 0.1
title:	Red Hat: Important: rh-nodejs10-nodejs security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20192939 - Security Advisory	Trust: 0.1
title:	Red Hat: Important: EAP Continuous Delivery Technical Preview Release 18 security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20202565 - Security Advisory	Trust: 0.1
title:	Arch Linux Advisories: [ASA-201908-17] libnghttp2: denial of service	url:	https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-201908-17	Trust: 0.1
title:	Amazon Linux 2: ALAS2-2019-1298	url:	https://vulmon.com/vendoradvisory?qidtp=amazon_linux2&qid=ALAS2-2019-1298	Trust: 0.1
title:	Amazon Linux AMI: ALAS-2019-1299	url:	https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2019-1299	Trust: 0.1
title:	Amazon Linux 2: ALAS2-2019-1342	url:	https://vulmon.com/vendoradvisory?qidtp=amazon_linux2&qid=ALAS2-2019-1342	Trust: 0.1
title:	Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20193935 - Security Advisory	Trust: 0.1
title:	Arch Linux Advisories: [ASA-201908-12] nginx-mainline: denial of service	url:	https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-201908-12	Trust: 0.1
title:	Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20193932 - Security Advisory	Trust: 0.1
title:	Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20193933 - Security Advisory	Trust: 0.1
title:	Red Hat: Important: Red Hat AMQ Broker 7.4.3 release and security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20201445 - Security Advisory	Trust: 0.1
title:	Red Hat: Important: Red Hat AMQ Broker 7.6 release and security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20200922 - Security Advisory	Trust: 0.1
title:	Debian Security Advisories: DSA-4669-1 nodejs -- security update	url:	https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=0919b27d8bf334fac6a8fbea7195b6b0	Trust: 0.1
title:	Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - October 2019	url:	https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=1258fbf11199f28879a6fcc9f39902e9	Trust: 0.1
title:	IBM: IBM Security Bulletin: Version 8.15.0 of Node.js included in IBM Cloud Event Management 2.3.0 has several security vulnerabilities.	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=3b9c6b5fbfb51d956856e88dff5a7acd	Trust: 0.1
title:	IBM: IBM Security Bulletin: Node.js vulnerabilities affect IBM Spectrum Control (formerly Tivoli Storage Productivity Center) (CVE-2019-9511, CVE-2019-9512, CVE-2019-9513, CVE-2019-9514, CVE-2019-9515, CVE-2019-9516, CVE-2019-9517, CVE-2019-9518)	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=5ad9418973cac91ba73c01ad16b1f5a4	Trust: 0.1
title:	IBM: IBM Security Bulletin: Multiple vulnerabilities affect IBMÂ® SDK for Node.jsâ„¢ in IBM Cloud	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=89d19e42a01e098dd5f88e0433d2bb5d	Trust: 0.1
title:	IBM: Security Bulletin: IBM Cloud Transformation Advisor is affected by a Node.js vulnerabilities	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=8f76cfb8f0c5ea84a0bc28705788f854	Trust: 0.1
title:	IBM: IBM Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud App Management	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=1ce0280dd79176d32c26f34906d1d4de	Trust: 0.1
title:	IBM: IBM Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud App Management	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=b76ff63209def4a949aa18bdf6b518b8	Trust: 0.1
title:	IBM: IBM Security Bulletin: Multiple vulnerabilities in Node.js affect IBM i	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=247686da02fe524817c1939b0f6b6a5c	Trust: 0.1
title:	Red Hat: Important: Red Hat Fuse 7.7.0 release and security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20203192 - Security Advisory	Trust: 0.1
title:	Red Hat: Important: Red Hat build of Thorntail 2.5.1 security and bug fix update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20202067 - Security Advisory	Trust: 0.1
title:	Fortinet Security Advisories: HTTP/2 Multiple DoS Attacks (VU#605641)	url:	https://vulmon.com/vendoradvisory?qidtp=fortinet_security_advisories&qid=FG-IR-19-225	Trust: 0.1
title:	bogeitingress	url:	https://github.com/lieshoujieyuan/bogeitingress	Trust: 0.1

sources: VULMON: CVE-2019-9511

EXTERNAL IDS

db:	NVD	id:	CVE-2019-9511	Trust: 2.1
db:	CERT/CC	id:	VU#605641	Trust: 1.9
db:	MCAFEE	id:	SB10296	Trust: 1.1
db:	PACKETSTORM	id:	154284	Trust: 0.2
db:	PACKETSTORM	id:	154510	Trust: 0.2
db:	PACKETSTORM	id:	154533	Trust: 0.2
db:	PACKETSTORM	id:	154190	Trust: 0.2
db:	PACKETSTORM	id:	154725	Trust: 0.1
db:	PACKETSTORM	id:	158636	Trust: 0.1
db:	PACKETSTORM	id:	154693	Trust: 0.1
db:	PACKETSTORM	id:	154401	Trust: 0.1
db:	PACKETSTORM	id:	154712	Trust: 0.1
db:	PACKETSTORM	id:	154117	Trust: 0.1
db:	PACKETSTORM	id:	154663	Trust: 0.1
db:	PACKETSTORM	id:	154471	Trust: 0.1
db:	PACKETSTORM	id:	154699	Trust: 0.1
db:	PACKETSTORM	id:	154470	Trust: 0.1
db:	PACKETSTORM	id:	154848	Trust: 0.1
db:	CNNVD	id:	CNNVD-201908-924	Trust: 0.1
db:	VULHUB	id:	VHN-160946	Trust: 0.1
db:	VULMON	id:	CVE-2019-9511	Trust: 0.1
db:	PACKETSTORM	id:	168812	Trust: 0.1
db:	PACKETSTORM	id:	180394	Trust: 0.1
db:	PACKETSTORM	id:	155479	Trust: 0.1
db:	PACKETSTORM	id:	157214	Trust: 0.1
db:	PACKETSTORM	id:	156852	Trust: 0.1

sources: CERT/CC: VU#605641 // VULHUB: VHN-160946 // VULMON: CVE-2019-9511 // PACKETSTORM: 168812 // PACKETSTORM: 154510 // PACKETSTORM: 180394 // PACKETSTORM: 155479 // PACKETSTORM: 154190 // PACKETSTORM: 157214 // PACKETSTORM: 154533 // PACKETSTORM: 154284 // PACKETSTORM: 156852 // NVD: CVE-2019-9511

REFERENCES

url:	https://github.com/netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md	Trust: 1.9
url:	https://www.synology.com/security/advisory/synology_sa_19_33	Trust: 1.9
url:	https://blogs.akamai.com/sitr/2019/08/http2-vulnerabilities.html	Trust: 1.6
url:	https://access.redhat.com/errata/rhsa-2019:2775	Trust: 1.2
url:	https://access.redhat.com/errata/rhsa-2019:2799	Trust: 1.2
url:	https://access.redhat.com/errata/rhsa-2019:4020	Trust: 1.2
url:	https://seclists.org/bugtraq/2019/aug/40	Trust: 1.1
url:	https://seclists.org/bugtraq/2019/sep/1	Trust: 1.1
url:	https://kb.cert.org/vuls/id/605641/	Trust: 1.1
url:	https://security.netapp.com/advisory/ntap-20190823-0002/	Trust: 1.1
url:	https://security.netapp.com/advisory/ntap-20190823-0005/	Trust: 1.1
url:	https://support.f5.com/csp/article/k02591030	Trust: 1.1
url:	https://www.debian.org/security/2019/dsa-4505	Trust: 1.1
url:	https://www.debian.org/security/2019/dsa-4511	Trust: 1.1
url:	https://www.debian.org/security/2020/dsa-4669	Trust: 1.1
url:	https://www.oracle.com/security-alerts/cpujan2021.html	Trust: 1.1
url:	https://www.oracle.com/security-alerts/cpuoct2020.html	Trust: 1.1
url:	https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html	Trust: 1.1
url:	https://access.redhat.com/errata/rhsa-2019:2692	Trust: 1.1
url:	https://access.redhat.com/errata/rhsa-2019:2745	Trust: 1.1
url:	https://access.redhat.com/errata/rhsa-2019:2746	Trust: 1.1
url:	https://access.redhat.com/errata/rhsa-2019:2925	Trust: 1.1
url:	https://access.redhat.com/errata/rhsa-2019:2939	Trust: 1.1
url:	https://access.redhat.com/errata/rhsa-2019:2949	Trust: 1.1
url:	https://access.redhat.com/errata/rhsa-2019:2955	Trust: 1.1
url:	https://access.redhat.com/errata/rhsa-2019:2966	Trust: 1.1
url:	https://access.redhat.com/errata/rhsa-2019:3041	Trust: 1.1
url:	https://access.redhat.com/errata/rhsa-2019:3932	Trust: 1.1
url:	https://access.redhat.com/errata/rhsa-2019:3933	Trust: 1.1
url:	https://access.redhat.com/errata/rhsa-2019:3935	Trust: 1.1
url:	https://access.redhat.com/errata/rhsa-2019:4018	Trust: 1.1
url:	https://access.redhat.com/errata/rhsa-2019:4019	Trust: 1.1
url:	https://access.redhat.com/errata/rhsa-2019:4021	Trust: 1.1
url:	http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html	Trust: 1.1
url:	http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html	Trust: 1.1
url:	http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html	Trust: 1.1
url:	http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.html	Trust: 1.1
url:	http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.html	Trust: 1.1
url:	http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html	Trust: 1.1
url:	https://usn.ubuntu.com/4099-1/	Trust: 1.1
url:	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/xhtku7yq5eep2xnsav4m4vj7qcbojmod/	Trust: 1.0
url:	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/bp556leg3wenhzi5taq6zebftjb4e2is/	Trust: 1.0
url:	https://kc.mcafee.com/corporate/index?page=content&id=sb10296	Trust: 1.0
url:	https://support.f5.com/csp/article/k02591030?utm_source=f5support&amp%3butm_medium=rss	Trust: 1.0
url:	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/tazzevtcn2b4wt6aibj7xgyjmbtorju5/	Trust: 1.0
url:	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/jubyaf6ed3o4xchq5c2hyenjlxyxzc4m/	Trust: 1.0
url:	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/popaec4fwl4uu4ldegpy5npalu24ffqd/	Trust: 1.0
url:	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/lzluypyy3rx4zjdwzrjiksulyrj4pxw7/	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2019-9511	Trust: 0.9
url:	https://vuls.cert.org/confluence/pages/viewpage.action?pageid=56393752	Trust: 0.8
url:	https://tools.ietf.org/html/rfc7540	Trust: 0.8
url:	https://tools.ietf.org/html/rfc7541	Trust: 0.8
url:	https://blog.cloudflare.com/on-the-recent-http-2-dos-attacks/	Trust: 0.8
url:	https://blog.litespeedtech.com/2019/08/15/litespeed-addresses-http-2-dos-advisories/	Trust: 0.8
url:	https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/cve-2019-9511https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/cve-2019-9512https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/cve-2019-9513https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/cve-2019-9514https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/cve-2019-9518	Trust: 0.8
url:	https://access.redhat.com/security/updates/classification/#important	Trust: 0.6
url:	https://nvd.nist.gov/vuln/detail/cve-2019-9513	Trust: 0.5
url:	https://www.redhat.com/mailman/listinfo/rhsa-announce	Trust: 0.5
url:	https://access.redhat.com/security/cve/cve-2019-9511	Trust: 0.5
url:	https://nvd.nist.gov/vuln/detail/cve-2019-9516	Trust: 0.5
url:	https://bugzilla.redhat.com/):	Trust: 0.5
url:	https://access.redhat.com/security/team/contact/	Trust: 0.5
url:	https://nvd.nist.gov/vuln/detail/cve-2019-9514	Trust: 0.4
url:	https://access.redhat.com/security/cve/cve-2019-9516	Trust: 0.4
url:	https://www.debian.org/security/faq	Trust: 0.3
url:	https://www.debian.org/security/	Trust: 0.3
url:	https://access.redhat.com/security/team/key/	Trust: 0.3
url:	https://access.redhat.com/articles/11258	Trust: 0.3
url:	https://nvd.nist.gov/vuln/detail/cve-2019-9515	Trust: 0.3
url:	https://access.redhat.com/security/cve/cve-2019-9512	Trust: 0.3
url:	https://access.redhat.com/security/cve/cve-2019-9514	Trust: 0.3
url:	https://access.redhat.com/security/cve/cve-2019-9515	Trust: 0.3
url:	https://nvd.nist.gov/vuln/detail/cve-2019-9512	Trust: 0.3
url:	https://access.redhat.com/security/cve/cve-2019-9513	Trust: 0.2
url:	https://access.redhat.com/security/cve/cve-2019-0222	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2019-9517	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2019-20444	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2019-10247	Trust: 0.2
url:	https://access.redhat.com/security/cve/cve-2019-9517	Trust: 0.2
url:	https://access.redhat.com/security/cve/cve-2019-20445	Trust: 0.2
url:	https://access.redhat.com/security/cve/cve-2019-9518	Trust: 0.2
url:	https://access.redhat.com/security/cve/cve-2019-20444	Trust: 0.2
url:	https://access.redhat.com/security/cve/cve-2019-16869	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2019-0222	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2020-7238	Trust: 0.2
url:	https://access.redhat.com/security/cve/cve-2020-7238	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2019-10241	Trust: 0.2
url:	https://access.redhat.com/security/cve/cve-2019-10247	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2019-16869	Trust: 0.2
url:	https://access.redhat.com/security/cve/cve-2019-10241	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2019-20445	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2019-9518	Trust: 0.2
url:	https://kc.mcafee.com/corporate/index?page=content&id=sb10296	Trust: 0.1
url:	https://support.f5.com/csp/article/k02591030?utm_source=f5support&amp;utm_medium=rss	Trust: 0.1
url:	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/bp556leg3wenhzi5taq6zebftjb4e2is/	Trust: 0.1
url:	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/xhtku7yq5eep2xnsav4m4vj7qcbojmod/	Trust: 0.1
url:	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/popaec4fwl4uu4ldegpy5npalu24ffqd/	Trust: 0.1
url:	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/lzluypyy3rx4zjdwzrjiksulyrj4pxw7/	Trust: 0.1
url:	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/jubyaf6ed3o4xchq5c2hyenjlxyxzc4m/	Trust: 0.1
url:	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/tazzevtcn2b4wt6aibj7xgyjmbtorju5/	Trust: 0.1
url:	https://security-tracker.debian.org/tracker/nodejs	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2019-15606	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2019-15604	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2019-15605	Trust: 0.1
url:	https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1703469	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1752980	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1807305	Trust: 0.1
url:	https://issues.redhat.com/browse/jbeap-24826	Trust: 0.1
url:	https://access.redhat.com/errata/rhsa-2024:5856	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1752770	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1735745	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1735744	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1737517	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1798524	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=2041949	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=2031667	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1725807	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1758619	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1793970	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=2041959	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1798509	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=2041967	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1772464	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1775293	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1767483	Trust: 0.1
url:	https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_5856.json	Trust: 0.1
url:	https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1741860	Trust: 0.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1735645	Trust: 0.1
url:	https://issues.jboss.org/):	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2019-14843	Trust: 0.1
url:	https://access.redhat.com/security/cve/cve-2019-14838	Trust: 0.1
url:	https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/html-single/installation_guide/	Trust: 0.1
url:	https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/	Trust: 0.1
url:	https://access.redhat.com/security/cve/cve-2019-14843	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2019-14838	Trust: 0.1
url:	https://security-tracker.debian.org/tracker/nginx	Trust: 0.1
url:	https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=jboss.amq.broker&version=7.4.3	Trust: 0.1
url:	https://access.redhat.com/errata/rhsa-2020:1445	Trust: 0.1
url:	https://access.redhat.com/documentation/en-us/red_hat_amq/7.4/	Trust: 0.1
url:	https://security-tracker.debian.org/tracker/nghttp2	Trust: 0.1
url:	https://access.redhat.com/documentation/en-us/red_hat_amq/7.6/	Trust: 0.1
url:	https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=jboss.amq.broker&version=7.6.0&productchanged=yes	Trust: 0.1
url:	https://access.redhat.com/errata/rhsa-2020:0922	Trust: 0.1

sources: CERT/CC: VU#605641 // VULHUB: VHN-160946 // PACKETSTORM: 168812 // PACKETSTORM: 154510 // PACKETSTORM: 180394 // PACKETSTORM: 155479 // PACKETSTORM: 154190 // PACKETSTORM: 157214 // PACKETSTORM: 154533 // PACKETSTORM: 154284 // PACKETSTORM: 156852 // NVD: CVE-2019-9511

CREDITS

Red Hat

Trust: 0.6

sources: PACKETSTORM: 154510 // PACKETSTORM: 180394 // PACKETSTORM: 155479 // PACKETSTORM: 157214 // PACKETSTORM: 154533 // PACKETSTORM: 156852

SOURCES

db:	CERT/CC	id:	VU#605641
db:	VULHUB	id:	VHN-160946
db:	VULMON	id:	CVE-2019-9511
db:	PACKETSTORM	id:	168812
db:	PACKETSTORM	id:	154510
db:	PACKETSTORM	id:	180394
db:	PACKETSTORM	id:	155479
db:	PACKETSTORM	id:	154190
db:	PACKETSTORM	id:	157214
db:	PACKETSTORM	id:	154533
db:	PACKETSTORM	id:	154284
db:	PACKETSTORM	id:	156852
db:	NVD	id:	CVE-2019-9511

LAST UPDATE DATE

2026-04-06T20:57:30.711000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#605641	date:	2019-11-19T00:00:00
db:	VULHUB	id:	VHN-160946	date:	2020-10-22T00:00:00
db:	VULMON	id:	CVE-2019-9511	date:	2022-08-12T00:00:00
db:	NVD	id:	CVE-2019-9511	date:	2025-01-14T19:29:55.853

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#605641	date:	2019-08-13T00:00:00
db:	VULHUB	id:	VHN-160946	date:	2019-08-13T00:00:00
db:	VULMON	id:	CVE-2019-9511	date:	2019-08-13T00:00:00
db:	PACKETSTORM	id:	168812	date:	2020-04-28T19:12:00
db:	PACKETSTORM	id:	154510	date:	2019-09-17T20:58:22
db:	PACKETSTORM	id:	180394	date:	2024-08-27T14:58:09
db:	PACKETSTORM	id:	155479	date:	2019-11-27T15:37:53
db:	PACKETSTORM	id:	154190	date:	2019-08-22T20:20:23
db:	PACKETSTORM	id:	157214	date:	2020-04-14T15:39:41
db:	PACKETSTORM	id:	154533	date:	2019-09-19T16:28:51
db:	PACKETSTORM	id:	154284	date:	2019-09-02T17:39:28
db:	PACKETSTORM	id:	156852	date:	2020-03-23T15:57:42
db:	NVD	id:	CVE-2019-9511	date:	2019-08-13T21:15:12.223