2019-03-01 12:04:26 -05:00
{
2019-03-17 23:18:22 +00:00
"CVE_data_meta" : {
2019-08-13 00:57:51 -04:00
"AKA" : "HTTP/2 Data Dribble" ,
"ASSIGNER" : "cert@cert.org" ,
2019-03-17 23:18:22 +00:00
"ID" : "CVE-2019-9511" ,
2019-08-13 00:57:51 -04:00
"STATE" : "PUBLIC" ,
"TITLE" : "Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service"
2019-03-17 23:18:22 +00:00
} ,
2019-08-13 00:57:51 -04:00
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "n/a" ,
"version" : {
"version_data" : [
{
"version_value" : "n/a"
}
]
}
}
]
} ,
"vendor_name" : "n/a"
}
]
}
} ,
"credit" : [
{
"lang" : "eng" ,
"value" : "Thanks to Jonathan Looney of Netflix for reporting this vulnerability."
}
] ,
2019-03-17 23:18:22 +00:00
"data_format" : "MITRE" ,
"data_type" : "CVE" ,
"data_version" : "4.0" ,
"description" : {
"description_data" : [
{
"lang" : "eng" ,
2019-08-13 00:57:51 -04:00
"value" : "Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both."
}
]
} ,
"generator" : {
"engine" : "Vulnogram 0.0.7"
} ,
"impact" : {
"cvss" : {
"attackComplexity" : "LOW" ,
"attackVector" : "NETWORK" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 7.5 ,
"baseSeverity" : "HIGH" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "NONE" ,
"privilegesRequired" : "NONE" ,
"scope" : "UNCHANGED" ,
"userInteraction" : "NONE" ,
"vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" ,
"version" : "3.0"
}
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "CWE-400 Uncontrolled Resource Consumption"
}
]
}
]
} ,
"references" : {
"reference_data" : [
{
"name" : "VU#605641" ,
"refsource" : "CERT-VN" ,
"url" : "https://kb.cert.org/vuls/id/605641/"
2019-08-13 14:51:11 -04:00
} ,
{
"name" : "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" ,
"refsource" : "MISC" ,
"url" : "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md"
2019-08-15 20:00:46 +00:00
} ,
{
"refsource" : "UBUNTU" ,
"name" : "USN-4099-1" ,
"url" : "https://usn.ubuntu.com/4099-1/"
2019-08-18 05:00:47 +00:00
} ,
{
"refsource" : "CONFIRM" ,
"name" : "https://www.synology.com/security/advisory/Synology_SA_19_33" ,
"url" : "https://www.synology.com/security/advisory/Synology_SA_19_33"
2019-08-20 05:00:46 +00:00
} ,
{
"refsource" : "CONFIRM" ,
"name" : "https://support.f5.com/csp/article/K02591030" ,
"url" : "https://support.f5.com/csp/article/K02591030"
2019-08-22 03:00:50 +00:00
} ,
{
"refsource" : "FEDORA" ,
"name" : "FEDORA-2019-befd924cfe" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/"
2019-08-22 22:00:50 +00:00
} ,
{
"refsource" : "BUGTRAQ" ,
"name" : "20190822 [SECURITY] [DSA 4505-1] nginx security update" ,
"url" : "https://seclists.org/bugtraq/2019/Aug/40"
2019-08-23 03:01:02 +00:00
} ,
{
"refsource" : "FEDORA" ,
"name" : "FEDORA-2019-81985a8858" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/"
2019-08-23 11:00:49 +00:00
} ,
{
"refsource" : "DEBIAN" ,
"name" : "DSA-4505" ,
"url" : "https://www.debian.org/security/2019/dsa-4505"
2019-08-23 21:00:48 +00:00
} ,
{
"refsource" : "CONFIRM" ,
"name" : "https://security.netapp.com/advisory/ntap-20190823-0002/" ,
"url" : "https://security.netapp.com/advisory/ntap-20190823-0002/"
} ,
{
"refsource" : "CONFIRM" ,
"name" : "https://security.netapp.com/advisory/ntap-20190823-0005/" ,
"url" : "https://security.netapp.com/advisory/ntap-20190823-0005/"
2019-08-27 21:00:47 +00:00
} ,
{
"refsource" : "FEDORA" ,
"name" : "FEDORA-2019-8a437d5c2f" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/"
2019-08-30 03:00:50 +00:00
} ,
{
"refsource" : "FEDORA" ,
"name" : "FEDORA-2019-4427fd65be" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/"
2019-08-30 16:00:50 +00:00
} ,
{
"refsource" : "FEDORA" ,
"name" : "FEDORA-2019-63ba15cc83" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/"
2019-09-02 11:00:58 +00:00
} ,
{
"refsource" : "BUGTRAQ" ,
"name" : "20190902 [SECURITY] [DSA 4511-1] nghttp2 security update" ,
"url" : "https://seclists.org/bugtraq/2019/Sep/1"
2019-09-04 06:01:00 +00:00
} ,
{
"refsource" : "DEBIAN" ,
"name" : "DSA-4511" ,
"url" : "https://www.debian.org/security/2019/dsa-4511"
} ,
{
"refsource" : "FEDORA" ,
"name" : "FEDORA-2019-7a0b45fdc4" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/"
2019-03-17 23:18:22 +00:00
}
]
2019-08-13 00:57:51 -04:00
} ,
"source" : {
"discovery" : "UNKNOWN"
2019-03-17 23:18:22 +00:00
}
2019-08-15 20:00:46 +00:00
}
