CVE-2019-9516

NameCVE-2019-9516
DescriptionSome HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4505-1
Debian Bugs935037

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nginx (PTS)jessie1.6.2-5+deb8u5fixed
jessie (security)1.6.2-5+deb8u6fixed
stretch1.10.3-1+deb9u2vulnerable
stretch (security)1.10.3-1+deb9u3fixed
buster1.14.2-2vulnerable
buster (security)1.14.2-2+deb10u1fixed
bullseye, sid1.14.2-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nginxsource(unstable)1.14.2-3935037
nginxsourcebuster1.14.2-2+deb10u1DSA-4505-1
nginxsourcejessie(not affected)
nginxsourcestretch1.10.3-1+deb9u3DSA-4505-1

Notes

[jessie] - nginx <not-affected> (HTTP2 support only exists since version 1.9.5)
https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
https://github.com/nginx/nginx/commit/6dfbc8b1c2116f362bb871efebbf9df576738e89 (master)
https://github.com/nginx/nginx/commit/dbdd9ffea81d9db46fb88b5eba828f2ad080d388 (release-1.16.1)
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

Search for package or bug name: Reporting problems