Tracker / CVE-2019-9517
CVE-2019-9517
Alta 7.5
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.
Prodotti e versioni affette
| apache | http_server · 2.4.20 → 2.4.40 |
|---|---|
| apache | traffic_server · 6.0.0 → 6.2.3 |
| apache | traffic_server · 7.0.0 → 7.1.6 |
| apache | traffic_server · 8.0.0 → 8.0.3 |
| apple | swiftnio · 1.0.0 → 1.4.0 |
| canonical | ubuntu_linux |
| debian | debian_linux |
| fedoraproject | fedora |
| mcafee | web_gateway · 7.7.2.0 → 7.7.2.24 |
| mcafee | web_gateway · 7.8.2.0 → 7.8.2.13 |
| mcafee | web_gateway · 8.1.0 → 8.2.0 |
| netapp | clustered_data_ontap |
| nodejs | node.js · 10.0.0 → 10.12.0 |
| nodejs | node.js · 10.13.0 → 10.16.3 |
| nodejs | node.js · 12.0.0 → 12.8.1 |
| nodejs | node.js · 8.0.0 → 8.8.1 |
| nodejs | node.js · 8.9.0 → 8.16.1 |
| opensuse | leap |
| oracle | communications_element_manager |
| oracle | graalvm |
| oracle | instantis_enterprisetrack · 17.1 → 17.3 |
| oracle | retail_xstore_point_of_service |
| redhat | enterprise_linux |
| redhat | jboss_core_services |
| redhat | jboss_enterprise_application_platform |
| redhat | openshift_service_mesh |
| redhat | quay |
| redhat | software_collections |
| synology | diskstation_manager |
| synology | skynas |
| synology | vs960hd_firmware |
Analisi
Questa pagina non è ancora indicizzabile.Finché non contiene un’analisi originale — cosa espone davvero, come verificare in due minuti se un sistema è stato toccato, cosa fare se lo è stato — la pagina resta noindex. È il database a deciderlo, non il modello di pagina.