CVE-2019-9513

NameCVE-2019-9513
DescriptionSome HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4505-1
Debian Bugs934885, 935037

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nghttp2 (PTS)jessie0.6.4-2vulnerable
stretch1.18.1-1vulnerable
buster1.36.0-2vulnerable
bullseye, sid1.39.2-1fixed
nginx (PTS)jessie1.6.2-5+deb8u5fixed
jessie (security)1.6.2-5+deb8u6fixed
stretch1.10.3-1+deb9u2vulnerable
stretch (security)1.10.3-1+deb9u3fixed
buster1.14.2-2vulnerable
buster (security)1.14.2-2+deb10u1fixed
bullseye, sid1.14.2-3fixed
nodejs (PTS)jessie0.10.29~dfsg-2fixed
stretch4.8.2~dfsg-1fixed
bullseye, sid, buster10.15.2~dfsg-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nghttp2source(unstable)1.39.2-1
nginxsource(unstable)1.14.2-3935037
nginxsourcebuster1.14.2-2+deb10u1DSA-4505-1
nginxsourcejessie(not affected)
nginxsourcestretch1.10.3-1+deb9u3DSA-4505-1
nodejssource(unstable)(unfixed)934885
nodejssourcejessie(not affected)
nodejssourcestretch(not affected)

Notes

[jessie] - nginx <not-affected> (HTTP2 support only exists since version 1.9.5)
[stretch] - nodejs <not-affected> (No HTTP2 support yet)
[jessie] - nodejs <not-affected> (No HTTP2 support yet)
https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
https://github.com/nginx/nginx/commit/5ae726912654da10a9a81b2c8436829f3e94f69f (master)
https://github.com/nginx/nginx/commit/39bb3b9d4a33bd03c8ae0134dedc8a7700ae7b2b (release-1.16.1)
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
https://github.com/nghttp2/nghttp2/releases/tag/v1.39.2

Search for package or bug name: Reporting problems