CVE-2019-9512

Published: 13 August 2019

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

From the Ubuntu Security Team

It was discovered that Netty incorrectly implements HTTP/2. An attacker could possibly use this issue to cause a denial of service.

Notes

Author	Note
sbeattie	nginx added http2 support in 1.9.5 nginx previously fixed issue for CVE-2018-16844 netty added http2 support in 4.1.0 nghttp2: nghttpd and nghttp are affected, libnghttp2 is not twisted added http2 support in 16.3 trafficserver enabled http2 support by default in 7.0
mdeslaur	Packages built using golang need to be rebuilt once the vulnerability has been fixed. This CVE entry does not list packages that need rebuilding outside of the main repository or the Ubuntu variants with PPA overlays.

Author

Note

sbeattie

nginx added http2 support in 1.9.5
nginx previously fixed issue for CVE-2018-16844
netty added http2 support in 4.1.0
nghttp2: nghttpd and nghttp are affected, libnghttp2 is not
twisted added http2 support in 16.3
trafficserver enabled http2 support by default in 7.0

mdeslaur

Packages built using golang need to be rebuilt once the
vulnerability has been fixed. This CVE entry does not
list packages that need rebuilding outside of the main
repository or the Ubuntu variants with PPA overlays.

Priority

Cvss 3 Severity Score

7.5

Score breakdown

Status

Package	Release	Status
golang-1.9 Launchpad, Ubuntu, Debian	bionic	Needed
	disco	Does not exist
	impish	Does not exist
	hirsute	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	eoan	Does not exist
	focal	Does not exist
	groovy	Does not exist
	lunar	Does not exist
	upstream	Needs triage
	xenial	Does not exist
	mantic	Does not exist
golang-1.10 Launchpad, Ubuntu, Debian	bionic	Needed
	eoan	Does not exist
	focal	Does not exist
	impish	Does not exist
	groovy	Does not exist
	hirsute	Does not exist
	xenial	Needs triage
	jammy	Does not exist
	kinetic	Does not exist
	disco	Ignored (end of life)
	lunar	Does not exist
	upstream	Needs triage
	mantic	Does not exist
golang-1.11 Launchpad, Ubuntu, Debian	bionic	Does not exist
	disco	Ignored (end of life)
	eoan	Does not exist
	focal	Does not exist
	upstream	Needs triage
	xenial	Does not exist
	impish	Does not exist
	groovy	Does not exist
	hirsute	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	lunar	Does not exist
	mantic	Does not exist
	Patches: upstream: https://github.com/golang/go/commit/e152b01a468a1c18a290bf9aec52ccea7693c7f2
golang-1.12 Launchpad, Ubuntu, Debian	bionic	Does not exist
	disco	Ignored (end of life)
	eoan	Ignored (end of life)
	focal	Does not exist
	upstream	Needs triage
	xenial	Does not exist
	impish	Does not exist
	groovy	Does not exist
	hirsute	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	lunar	Does not exist
	mantic	Does not exist
	Patches: upstream: https://github.com/golang/go/commit/7139b45d1410ded14e1e131151fd8dfc435ede6c
golang-1.6 Launchpad, Ubuntu, Debian	xenial	Needs triage
	impish	Does not exist
	groovy	Does not exist
	hirsute	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	bionic	Does not exist
	disco	Does not exist
	eoan	Does not exist
	focal	Does not exist
	lunar	Does not exist
	upstream	Needs triage
	mantic	Does not exist
h2o Launchpad, Ubuntu, Debian	bionic	Needs triage
	impish	Not vulnerable (2.2.5+dfsg2-3)
	hirsute	Not vulnerable (2.2.5+dfsg2-3)
	jammy	Not vulnerable (2.2.5+dfsg2-3)
	kinetic	Not vulnerable (2.2.5+dfsg2-3)
	disco	Released (2.2.5+dfsg2-2+deb10u1build0.19.04.1)
	eoan	Not vulnerable (2.2.5+dfsg2-3)
	focal	Not vulnerable (2.2.5+dfsg2-3)
	groovy	Not vulnerable (2.2.5+dfsg2-3)
	lunar	Not vulnerable (2.2.5+dfsg2-3)
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
	mantic	Not vulnerable (2.2.5+dfsg2-3)
golang Launchpad, Ubuntu, Debian	impish	Does not exist
	groovy	Does not exist
	hirsute	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	bionic	Does not exist
	disco	Does not exist
	eoan	Does not exist
	focal	Does not exist
	lunar	Does not exist
	upstream	Needs triage
	xenial	Does not exist
	mantic	Does not exist
golang-1.7 Launchpad, Ubuntu, Debian	impish	Does not exist
	groovy	Does not exist
	hirsute	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	bionic	Does not exist
	disco	Does not exist
	eoan	Does not exist
	focal	Does not exist
	lunar	Does not exist
	upstream	Needs triage
	xenial	Does not exist
	mantic	Does not exist
golang-1.8 Launchpad, Ubuntu, Debian	impish	Does not exist
	groovy	Does not exist
	bionic	Needed
	hirsute	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	disco	Does not exist
	eoan	Does not exist
	focal	Does not exist
	lunar	Does not exist
	upstream	Needs triage
	xenial	Does not exist
	mantic	Does not exist
nginx Launchpad, Ubuntu, Debian	impish	Not vulnerable (fixed for CVE-2018-16844)
	jammy	Not vulnerable (fixed for CVE-2018-16844)
	kinetic	Not vulnerable (fixed for CVE-2018-16844)
	bionic	Not vulnerable (fixed for CVE-2018-16844)
	cosmic	Not vulnerable (fixed for CVE-2018-16844)
	disco	Not vulnerable (fixed for CVE-2018-16844)
	eoan	Not vulnerable (fixed for CVE-2018-16844)
	focal	Not vulnerable (fixed for CVE-2018-16844)
	groovy	Not vulnerable (fixed for CVE-2018-16844)
	hirsute	Not vulnerable (fixed for CVE-2018-16844)
	lunar	Not vulnerable (fixed for CVE-2018-16844)
	trusty	Not vulnerable (http2 support not implemented)
	upstream	Needs triage
	xenial	Not vulnerable (fixed for CVE-2018-16844)
	mantic	Not vulnerable (fixed for CVE-2018-16844)
trafficserver Launchpad, Ubuntu, Debian	impish	Not vulnerable (8.0.5+ds-1)
	jammy	Not vulnerable (8.0.5+ds-1)
	kinetic	Not vulnerable (8.0.5+ds-1)
	xenial	Needs triage
	bionic	Needed
	cosmic	Ignored (end of life)
	disco	Ignored (end of life)
	eoan	Not vulnerable (8.0.5+ds-1)
	focal	Not vulnerable (8.0.5+ds-1)
	groovy	Not vulnerable (8.0.5+ds-1)
	hirsute	Not vulnerable (8.0.5+ds-1)
	lunar	Not vulnerable (8.0.5+ds-1)
	trusty	Does not exist
	upstream	Needs triage
	mantic	Not vulnerable (8.0.5+ds-1)
twisted Launchpad, Ubuntu, Debian	impish	Released (18.9.0-6ubuntu1)
	jammy	Released (18.9.0-6ubuntu1)
	kinetic	Released (18.9.0-6ubuntu1)
	bionic	Released (17.9.0-2ubuntu0.1)
	cosmic	Ignored (end of life)
	disco	Ignored (end of life)
	eoan	Released (18.9.0-3ubuntu1.1)
	focal	Released (18.9.0-6ubuntu1)
	groovy	Released (18.9.0-6ubuntu1)
	hirsute	Released (18.9.0-6ubuntu1)
	lunar	Released (18.9.0-6ubuntu1)
	trusty	Not vulnerable (http2 support not implemented)
	upstream	Released (19.10.0)
	xenial	Not vulnerable (http2 support not implemented)
	mantic	Released (18.9.0-6ubuntu1)
	Patches: upstream: https://github.com/twisted/twisted/commit/1595d9adc21c580065d1d6036c9611c411990816
netty Launchpad, Ubuntu, Debian	kinetic	Ignored (end of life, was needed)
	jammy	Needed
	impish	Ignored (end of life)
	bionic	Released (1:4.1.7-4ubuntu0.1+esm1) Available with Ubuntu Pro
	cosmic	Ignored (end of life)
	disco	Ignored (end of life)
	eoan	Ignored (end of life)
	focal	Needed
	groovy	Ignored (end of life)
	hirsute	Ignored (end of life)
	lunar	Needed
	trusty	Not vulnerable (http2 support not implemented)
	upstream	Needs triage
	xenial	Not vulnerable (http2 support not implemented)
	mantic	Needed

Severity score breakdown

Parameter	Value
Base score	7.5
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Bugs

https://github.com/golang/go/issues/33606

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›