7.8
CVE-2019-9515
- EPSS 4.51%
- Published 13.08.2019 21:15:12
- Last modified 14.01.2025 19:29:55
- Source cret@cert.org
- Teams watchlist Login
- Open Login
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Data is provided by the National Vulnerability Database (NVD)
Apache ≫ Traffic Server Version >= 6.0.0 <= 6.2.3
Apache ≫ Traffic Server Version >= 7.0.0 <= 7.1.6
Apache ≫ Traffic Server Version >= 8.0.0 <= 8.0.3
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version19.04
Debian ≫ Debian Linux Version9.0
Debian ≫ Debian Linux Version10.0
Synology ≫ Diskstation Manager Version6.2
Synology ≫ Vs960hd Firmware Version-
Fedoraproject ≫ Fedora Version29
Fedoraproject ≫ Fedora Version30
Redhat ≫ Jboss Core Services Version1.0
Redhat ≫ Jboss Enterprise Application Platform Version7.2.0
Redhat ≫ Jboss Enterprise Application Platform Version7.3.0
Redhat ≫ Openshift Container Platform Version4.1
Redhat ≫ Openshift Service Mesh Version1.0
Redhat ≫ Single Sign-on Version7.3
Redhat ≫ Software Collections Version1.0
Redhat ≫ Enterprise Linux Version8.0
Mcafee ≫ Web Gateway Version >= 7.7.2.0 < 7.7.2.24
Mcafee ≫ Web Gateway Version >= 7.8.2.0 < 7.8.2.13
Mcafee ≫ Web Gateway Version >= 8.1.0 < 8.2.0
F5 ≫ Big-ip Local Traffic Manager Version >= 11.6.1 < 11.6.5.1
F5 ≫ Big-ip Local Traffic Manager Version >= 12.1.0 < 12.1.5.1
F5 ≫ Big-ip Local Traffic Manager Version >= 13.1.0 < 13.1.3.2
F5 ≫ Big-ip Local Traffic Manager Version >= 14.0.0 < 14.0.1.1
F5 ≫ Big-ip Local Traffic Manager Version >= 14.1.0 < 14.1.2.1
F5 ≫ Big-ip Local Traffic Manager Version >= 15.0.0 < 15.0.1.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 4.51% | 0.887 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| nvd@nist.gov | 7.8 | 10 | 6.9 |
AV:N/AC:L/Au:N/C:N/I:N/A:C
|
| cret@cert.org | 7.5 | 3.9 | 3.6 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
CWE-400 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CWE-770 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.