7.8
CVE-2019-9514
- EPSS 9.48%
- Published 13.08.2019 21:15:12
- Last modified 14.01.2025 19:29:55
- Source cret@cert.org
- Teams watchlist Login
- Open Login
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
Data is provided by the National Vulnerability Database (NVD)
Apache ≫ Traffic Server Version >= 6.0.0 <= 6.2.3
Apache ≫ Traffic Server Version >= 7.0.0 <= 7.1.6
Apache ≫ Traffic Server Version >= 8.0.0 <= 8.0.3
Debian ≫ Debian Linux Version10.0
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version19.04
Debian ≫ Debian Linux Version9.0
Debian ≫ Debian Linux Version10.0
Synology ≫ Diskstation Manager Version6.2
Synology ≫ Vs960hd Firmware Version-
Fedoraproject ≫ Fedora Version29
Fedoraproject ≫ Fedora Version30
Redhat ≫ Developer Tools Version1.0
Redhat ≫ Jboss Core Services Version1.0
Redhat ≫ Jboss Enterprise Application Platform Version7.2.0
Redhat ≫ Jboss Enterprise Application Platform Version7.3.0
Redhat ≫ Openshift Container Platform Version3.9
Redhat ≫ Openshift Container Platform Version3.10
Redhat ≫ Openshift Container Platform Version3.11
Redhat ≫ Openshift Container Platform Version4.1
Redhat ≫ Openshift Container Platform Version4.2
Redhat ≫ Openshift Service Mesh Version1.0
Redhat ≫ Single Sign-on Version7.3
Redhat ≫ Software Collections Version1.0
Redhat ≫ Enterprise Linux Version8.0
Redhat ≫ Enterprise Linux Eus Version8.1
Redhat ≫ Enterprise Linux Server Version7.0
Redhat ≫ Enterprise Linux Workstation Version7.0
Mcafee ≫ Web Gateway Version >= 7.7.2.0 < 7.7.2.24
Mcafee ≫ Web Gateway Version >= 7.8.2.0 < 7.8.2.13
Mcafee ≫ Web Gateway Version >= 8.1.0 < 8.2.0
Netapp ≫ Cloud Insights Version-
F5 ≫ Big-ip Local Traffic Manager Version >= 11.6.1 < 11.6.5.1
F5 ≫ Big-ip Local Traffic Manager Version >= 12.1.0 < 12.1.5.1
F5 ≫ Big-ip Local Traffic Manager Version >= 13.1.0 < 13.1.3.2
F5 ≫ Big-ip Local Traffic Manager Version >= 14.0.0 < 14.0.1.1
F5 ≫ Big-ip Local Traffic Manager Version >= 14.1.0 < 14.1.2.1
F5 ≫ Big-ip Local Traffic Manager Version >= 15.0.0 < 15.0.1.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 9.48% | 0.925 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| nvd@nist.gov | 7.8 | 10 | 6.9 |
AV:N/AC:L/Au:N/C:N/I:N/A:C
|
| cret@cert.org | 7.5 | 3.9 | 3.6 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
CWE-400 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CWE-770 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.