2019-03-01 12:04:26 -05:00
{
2019-10-16 18:01:15 +00:00
"CVE_data_meta" : {
"AKA" : "HTTP/2 Data Dribble" ,
"ASSIGNER" : "cert@cert.org" ,
"ID" : "CVE-2019-9511" ,
"STATE" : "PUBLIC" ,
"TITLE" : "Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service"
2019-03-17 23:18:22 +00:00
} ,
2019-10-16 18:01:15 +00:00
"affects" : {
"vendor" : {
"vendor_data" : [
2019-08-13 00:57:51 -04:00
{
2019-10-16 18:01:15 +00:00
"product" : {
"product_data" : [
2019-08-13 00:57:51 -04:00
{
2019-10-16 18:01:15 +00:00
"product_name" : "n/a" ,
"version" : {
"version_data" : [
2019-08-13 00:57:51 -04:00
{
2019-10-16 18:01:15 +00:00
"version_value" : "n/a"
2019-08-13 00:57:51 -04:00
}
]
}
}
]
} ,
2019-10-16 18:01:15 +00:00
"vendor_name" : "n/a"
2019-08-13 00:57:51 -04:00
}
]
}
} ,
2019-10-16 18:01:15 +00:00
"credit" : [
2019-08-13 00:57:51 -04:00
{
2019-10-16 18:01:15 +00:00
"lang" : "eng" ,
"value" : "Thanks to Jonathan Looney of Netflix for reporting this vulnerability."
2019-08-13 00:57:51 -04:00
}
] ,
2019-10-16 18:01:15 +00:00
"data_format" : "MITRE" ,
"data_type" : "CVE" ,
"data_version" : "4.0" ,
"description" : {
"description_data" : [
{
"lang" : "eng" ,
"value" : "Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both."
2019-08-13 00:57:51 -04:00
}
]
} ,
2019-10-16 18:01:15 +00:00
"generator" : {
"engine" : "Vulnogram 0.0.7"
2019-08-13 00:57:51 -04:00
} ,
2019-10-16 18:01:15 +00:00
"impact" : {
"cvss" : {
"attackComplexity" : "LOW" ,
"attackVector" : "NETWORK" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 7.5 ,
"baseSeverity" : "HIGH" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "NONE" ,
"privilegesRequired" : "NONE" ,
"scope" : "UNCHANGED" ,
"userInteraction" : "NONE" ,
"vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" ,
"version" : "3.0"
2019-08-13 00:57:51 -04:00
}
} ,
2019-10-16 18:01:15 +00:00
"problemtype" : {
"problemtype_data" : [
2019-08-13 00:57:51 -04:00
{
2019-10-16 18:01:15 +00:00
"description" : [
2019-08-13 00:57:51 -04:00
{
2019-10-16 18:01:15 +00:00
"lang" : "eng" ,
"value" : "CWE-400 Uncontrolled Resource Consumption"
2019-08-13 00:57:51 -04:00
}
]
}
]
} ,
2019-10-16 18:01:15 +00:00
"references" : {
"reference_data" : [
2019-08-13 00:57:51 -04:00
{
2019-10-16 18:01:15 +00:00
"name" : "VU#605641" ,
"refsource" : "CERT-VN" ,
"url" : "https://kb.cert.org/vuls/id/605641/"
2019-08-13 14:51:11 -04:00
} ,
2019-08-15 20:00:46 +00:00
{
2019-10-16 18:01:15 +00:00
"refsource" : "UBUNTU" ,
"name" : "USN-4099-1" ,
"url" : "https://usn.ubuntu.com/4099-1/"
2019-08-18 05:00:47 +00:00
} ,
2019-08-22 03:00:50 +00:00
{
2019-10-16 18:01:15 +00:00
"refsource" : "FEDORA" ,
"name" : "FEDORA-2019-befd924cfe" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/"
2019-08-22 22:00:50 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "BUGTRAQ" ,
"name" : "20190822 [SECURITY] [DSA 4505-1] nginx security update" ,
"url" : "https://seclists.org/bugtraq/2019/Aug/40"
2019-08-23 03:01:02 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "FEDORA" ,
"name" : "FEDORA-2019-81985a8858" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/"
2019-08-23 11:00:49 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "DEBIAN" ,
"name" : "DSA-4505" ,
"url" : "https://www.debian.org/security/2019/dsa-4505"
2019-08-23 21:00:48 +00:00
} ,
2019-08-27 21:00:47 +00:00
{
2019-10-16 18:01:15 +00:00
"refsource" : "FEDORA" ,
"name" : "FEDORA-2019-8a437d5c2f" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/"
2019-08-30 03:00:50 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "FEDORA" ,
"name" : "FEDORA-2019-4427fd65be" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/"
2019-08-30 16:00:50 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "FEDORA" ,
"name" : "FEDORA-2019-63ba15cc83" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/"
2019-09-02 11:00:58 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "BUGTRAQ" ,
"name" : "20190902 [SECURITY] [DSA 4511-1] nghttp2 security update" ,
"url" : "https://seclists.org/bugtraq/2019/Sep/1"
2019-09-04 06:01:00 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "DEBIAN" ,
"name" : "DSA-4511" ,
"url" : "https://www.debian.org/security/2019/dsa-4511"
2019-09-04 06:01:00 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "FEDORA" ,
"name" : "FEDORA-2019-7a0b45fdc4" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/"
2019-09-10 06:00:58 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:2692" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:2692"
2019-09-11 00:00:50 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "SUSE" ,
"name" : "openSUSE-SU-2019:2120" ,
"url" : "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html"
2019-09-11 00:00:50 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "SUSE" ,
"name" : "openSUSE-SU-2019:2114" ,
"url" : "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html"
2019-09-11 00:00:50 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "SUSE" ,
"name" : "openSUSE-SU-2019:2115" ,
"url" : "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html"
2019-09-11 09:00:49 +00:00
} ,
2019-09-12 15:00:48 +00:00
{
2019-10-16 18:01:15 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:2745" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:2745"
2019-09-12 15:00:48 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:2746" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:2746"
2019-09-17 18:00:54 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:2775" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:2775"
2019-09-19 11:00:54 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:2799" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:2799"
2019-09-30 10:00:57 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:2925" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:2925"
2019-10-01 02:01:01 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:2939" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:2939"
2019-10-01 16:01:00 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:2949" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:2949"
2019-10-01 18:01:03 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "SUSE" ,
"name" : "openSUSE-SU-2019:2232" ,
"url" : "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.html"
2019-10-01 21:00:57 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "SUSE" ,
"name" : "openSUSE-SU-2019:2234" ,
"url" : "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.html"
2019-10-02 17:00:58 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:2955" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:2955"
2019-10-03 23:00:56 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:2966" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:2966"
2019-10-06 15:00:59 +00:00
} ,
{
2019-10-16 18:01:15 +00:00
"refsource" : "SUSE" ,
"name" : "openSUSE-SU-2019:2264" ,
"url" : "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html"
2019-10-09 20:01:27 +00:00
} ,
2019-10-14 19:01:05 +00:00
{
2019-10-16 18:01:15 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:3041" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:3041"
2019-10-15 13:33:48 -07:00
} ,
2019-11-20 20:01:54 +00:00
{
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:3933" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:3933"
} ,
{
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:3935" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:3935"
2019-11-20 21:01:55 +00:00
} ,
{
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:3932" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:3932"
2019-11-26 23:02:07 +00:00
} ,
{
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:4018" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:4018"
} ,
{
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:4019" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:4019"
} ,
{
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:4021" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:4021"
} ,
{
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:4020" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:4020"
2020-04-30 13:01:13 +00:00
} ,
{
"refsource" : "DEBIAN" ,
"name" : "DSA-4669" ,
"url" : "https://www.debian.org/security/2020/dsa-4669"
2020-10-20 12:39:21 -07:00
} ,
{
2020-10-20 22:03:07 +00:00
"url" : "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html" ,
"refsource" : "MISC" ,
"name" : "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
} ,
{
"url" : "https://www.oracle.com/security-alerts/cpuoct2020.html" ,
"refsource" : "MISC" ,
"name" : "https://www.oracle.com/security-alerts/cpuoct2020.html"
} ,
{
"name" : "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" ,
"refsource" : "MISC" ,
"url" : "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md"
} ,
{
"refsource" : "CONFIRM" ,
"name" : "https://www.synology.com/security/advisory/Synology_SA_19_33" ,
"url" : "https://www.synology.com/security/advisory/Synology_SA_19_33"
} ,
{
"refsource" : "CONFIRM" ,
"name" : "https://support.f5.com/csp/article/K02591030" ,
"url" : "https://support.f5.com/csp/article/K02591030"
} ,
{
"refsource" : "CONFIRM" ,
"name" : "https://security.netapp.com/advisory/ntap-20190823-0002/" ,
"url" : "https://security.netapp.com/advisory/ntap-20190823-0002/"
} ,
{
"refsource" : "CONFIRM" ,
"name" : "https://security.netapp.com/advisory/ntap-20190823-0005/" ,
"url" : "https://security.netapp.com/advisory/ntap-20190823-0005/"
} ,
{
"refsource" : "CONFIRM" ,
"name" : "https://kc.mcafee.com/corporate/index?page=content&id=SB10296" ,
"url" : "https://kc.mcafee.com/corporate/index?page=content&id=SB10296"
} ,
{
"refsource" : "CONFIRM" ,
"name" : "https://support.f5.com/csp/article/K02591030?utm_source=f5support&utm_medium=RSS" ,
"url" : "https://support.f5.com/csp/article/K02591030?utm_source=f5support&utm_medium=RSS"
2021-01-19 13:08:08 -08:00
} ,
{
2021-01-20 15:02:47 +00:00
"url" : "https://www.oracle.com/security-alerts/cpujan2021.html" ,
"refsource" : "MISC" ,
"name" : "https://www.oracle.com/security-alerts/cpujan2021.html"
2019-03-17 23:18:22 +00:00
}
]
2019-08-13 00:57:51 -04:00
} ,
2019-10-16 18:01:15 +00:00
"source" : {
"discovery" : "UNKNOWN"
2019-03-17 23:18:22 +00:00
}
2019-08-15 20:00:46 +00:00
}