CVE-2019-9512
Published: 13 August 2019
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
From the Ubuntu Security Team
It was discovered that Netty incorrectly implements HTTP/2. An attacker could possibly use this issue to cause a denial of service.
Notes
Author | Note |
---|---|
sbeattie | nginx added http2 support in 1.9.5 nginx previously fixed issue for CVE-2018-16844 netty added http2 support in 4.1.0 nghttp2: nghttpd and nghttp are affected, libnghttp2 is not twisted added http2 support in 16.3 trafficserver enabled http2 support by default in 7.0 |
mdeslaur | Packages built using golang need to be rebuilt once the vulnerability has been fixed. This CVE entry does not list packages that need rebuilding outside of the main repository or the Ubuntu variants with PPA overlays. |
Priority
Status
Package | Release | Status |
---|---|---|
golang-1.9 Launchpad, Ubuntu, Debian |
bionic |
Needed
|
disco |
Does not exist
|
|
impish |
Does not exist
|
|
hirsute |
Does not exist
|
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
lunar |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
mantic |
Does not exist
|
|
golang-1.10 Launchpad, Ubuntu, Debian |
bionic |
Needed
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
impish |
Does not exist
|
|
groovy |
Does not exist
|
|
hirsute |
Does not exist
|
|
xenial |
Needs triage
|
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
disco |
Ignored
(end of life)
|
|
lunar |
Does not exist
|
|
upstream |
Needs triage
|
|
mantic |
Does not exist
|
|
golang-1.11 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
disco |
Ignored
(end of life)
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
impish |
Does not exist
|
|
groovy |
Does not exist
|
|
hirsute |
Does not exist
|
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
lunar |
Does not exist
|
|
mantic |
Does not exist
|
|
Patches: upstream: https://github.com/golang/go/commit/e152b01a468a1c18a290bf9aec52ccea7693c7f2 |
||
golang-1.12 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
disco |
Ignored
(end of life)
|
|
eoan |
Ignored
(end of life)
|
|
focal |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
impish |
Does not exist
|
|
groovy |
Does not exist
|
|
hirsute |
Does not exist
|
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
lunar |
Does not exist
|
|
mantic |
Does not exist
|
|
Patches: upstream: https://github.com/golang/go/commit/7139b45d1410ded14e1e131151fd8dfc435ede6c |
||
golang-1.6 Launchpad, Ubuntu, Debian |
xenial |
Needs triage
|
impish |
Does not exist
|
|
groovy |
Does not exist
|
|
hirsute |
Does not exist
|
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
bionic |
Does not exist
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
lunar |
Does not exist
|
|
upstream |
Needs triage
|
|
mantic |
Does not exist
|
|
h2o Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
impish |
Not vulnerable
(2.2.5+dfsg2-3)
|
|
hirsute |
Not vulnerable
(2.2.5+dfsg2-3)
|
|
jammy |
Not vulnerable
(2.2.5+dfsg2-3)
|
|
kinetic |
Not vulnerable
(2.2.5+dfsg2-3)
|
|
disco |
Released
(2.2.5+dfsg2-2+deb10u1build0.19.04.1)
|
|
eoan |
Not vulnerable
(2.2.5+dfsg2-3)
|
|
focal |
Not vulnerable
(2.2.5+dfsg2-3)
|
|
groovy |
Not vulnerable
(2.2.5+dfsg2-3)
|
|
lunar |
Not vulnerable
(2.2.5+dfsg2-3)
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
mantic |
Not vulnerable
(2.2.5+dfsg2-3)
|
|
golang Launchpad, Ubuntu, Debian |
impish |
Does not exist
|
groovy |
Does not exist
|
|
hirsute |
Does not exist
|
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
bionic |
Does not exist
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
lunar |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
mantic |
Does not exist
|
|
golang-1.7 Launchpad, Ubuntu, Debian |
impish |
Does not exist
|
groovy |
Does not exist
|
|
hirsute |
Does not exist
|
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
bionic |
Does not exist
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
lunar |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
mantic |
Does not exist
|
|
golang-1.8 Launchpad, Ubuntu, Debian |
impish |
Does not exist
|
groovy |
Does not exist
|
|
bionic |
Needed
|
|
hirsute |
Does not exist
|
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
lunar |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
mantic |
Does not exist
|
|
nginx Launchpad, Ubuntu, Debian |
impish |
Not vulnerable
(fixed for CVE-2018-16844)
|
jammy |
Not vulnerable
(fixed for CVE-2018-16844)
|
|
kinetic |
Not vulnerable
(fixed for CVE-2018-16844)
|
|
bionic |
Not vulnerable
(fixed for CVE-2018-16844)
|
|
cosmic |
Not vulnerable
(fixed for CVE-2018-16844)
|
|
disco |
Not vulnerable
(fixed for CVE-2018-16844)
|
|
eoan |
Not vulnerable
(fixed for CVE-2018-16844)
|
|
focal |
Not vulnerable
(fixed for CVE-2018-16844)
|
|
groovy |
Not vulnerable
(fixed for CVE-2018-16844)
|
|
hirsute |
Not vulnerable
(fixed for CVE-2018-16844)
|
|
lunar |
Not vulnerable
(fixed for CVE-2018-16844)
|
|
trusty |
Not vulnerable
(http2 support not implemented)
|
|
upstream |
Needs triage
|
|
xenial |
Not vulnerable
(fixed for CVE-2018-16844)
|
|
mantic |
Not vulnerable
(fixed for CVE-2018-16844)
|
|
trafficserver Launchpad, Ubuntu, Debian |
impish |
Not vulnerable
(8.0.5+ds-1)
|
jammy |
Not vulnerable
(8.0.5+ds-1)
|
|
kinetic |
Not vulnerable
(8.0.5+ds-1)
|
|
xenial |
Needs triage
|
|
bionic |
Needed
|
|
cosmic |
Ignored
(end of life)
|
|
disco |
Ignored
(end of life)
|
|
eoan |
Not vulnerable
(8.0.5+ds-1)
|
|
focal |
Not vulnerable
(8.0.5+ds-1)
|
|
groovy |
Not vulnerable
(8.0.5+ds-1)
|
|
hirsute |
Not vulnerable
(8.0.5+ds-1)
|
|
lunar |
Not vulnerable
(8.0.5+ds-1)
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
mantic |
Not vulnerable
(8.0.5+ds-1)
|
|
twisted Launchpad, Ubuntu, Debian |
impish |
Released
(18.9.0-6ubuntu1)
|
jammy |
Released
(18.9.0-6ubuntu1)
|
|
kinetic |
Released
(18.9.0-6ubuntu1)
|
|
bionic |
Released
(17.9.0-2ubuntu0.1)
|
|
cosmic |
Ignored
(end of life)
|
|
disco |
Ignored
(end of life)
|
|
eoan |
Released
(18.9.0-3ubuntu1.1)
|
|
focal |
Released
(18.9.0-6ubuntu1)
|
|
groovy |
Released
(18.9.0-6ubuntu1)
|
|
hirsute |
Released
(18.9.0-6ubuntu1)
|
|
lunar |
Released
(18.9.0-6ubuntu1)
|
|
trusty |
Not vulnerable
(http2 support not implemented)
|
|
upstream |
Released
(19.10.0)
|
|
xenial |
Not vulnerable
(http2 support not implemented)
|
|
mantic |
Released
(18.9.0-6ubuntu1)
|
|
Patches: upstream: https://github.com/twisted/twisted/commit/1595d9adc21c580065d1d6036c9611c411990816 |
||
netty Launchpad, Ubuntu, Debian |
kinetic |
Ignored
(end of life, was needed)
|
jammy |
Needed
|
|
impish |
Ignored
(end of life)
|
|
bionic |
Released
(1:4.1.7-4ubuntu0.1+esm1)
Available with Ubuntu Pro |
|
cosmic |
Ignored
(end of life)
|
|
disco |
Ignored
(end of life)
|
|
eoan |
Ignored
(end of life)
|
|
focal |
Needed
|
|
groovy |
Ignored
(end of life)
|
|
hirsute |
Ignored
(end of life)
|
|
lunar |
Needed
|
|
trusty |
Not vulnerable
(http2 support not implemented)
|
|
upstream |
Needs triage
|
|
xenial |
Not vulnerable
(http2 support not implemented)
|
|
mantic |
Needed
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.5 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | None |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- https://netty.io/news/2019/08/13/4-1-39-Final.html
- http://blog.kazuhooku.com/2019/08/h2o-version-226-230-beta2-released.html
- https://github.com/netty/netty/pull/9460
- https://labs.twistedmatrix.com/2019/11/twisted-19100-released.html
- https://ubuntu.com/security/notices/USN-4308-1
- https://ubuntu.com/security/notices/USN-4866-1
- NVD
- Launchpad
- Debian