CVE编号
CVE-2019-9518利用情况
暂无补丁情况
官方补丁披露时间
2019-08-13漏洞描述
某些HTTP / 2实施容易受到大量空框架的影响，有可能导致拒绝服务。攻击者发送有效载荷为空且没有流结束标志的帧流。这些帧可以是DATA，HEADERS，CONTINUATION和/或PUSH_PROMISE。对等体花费的时间不成比例地处理每个帧以攻击带宽。这会消耗过多的CPU。解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接 |
|
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html | |
| http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html | |
| http://seclists.org/fulldisclosure/2019/Aug/16 | |
| https://access.redhat.com/errata/RHSA-2019:2925 | |
| https://access.redhat.com/errata/RHSA-2019:2939 | |
| https://access.redhat.com/errata/RHSA-2019:2955 | |
| https://access.redhat.com/errata/RHSA-2019:3892 | |
| https://access.redhat.com/errata/RHSA-2019:4352 | |
| https://access.redhat.com/errata/RHSA-2020:0727 | |
| https://github.com/Netflix/security-bulletins/blob/master/advisories/third-pa... | |
| https://kb.cert.org/vuls/id/605641/ | |
| https://kc.mcafee.com/corporate/index?page=content&id=SB10296 | |
| https://lists.apache.org/thread.html/091b518265bce56a16af87b77c8cfacda902a020... | |
| https://lists.apache.org/thread.html/2653c56545573b528f3f6352a29eccaf498bd6fb... | |
| https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b... | |
| https://lists.apache.org/thread.html/ff5b0821a6985159a832ff6d1a4bd311ac07ecc7... | |
| https://lists.apache.org/thread.html/r99a625fb17032646d96cd23dec49603ff630e93... | |
| https://lists.apache.org/thread.html/rd31230d01fa6aad18bdadc0720acd1747e53690... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-9518 | |
| https://seclists.org/bugtraq/2019/Aug/24 | |
| https://seclists.org/bugtraq/2019/Sep/18 | |
| https://security.netapp.com/advisory/ntap-20190823-0005/ | |
| https://support.f5.com/csp/article/K46011592 | |
| https://support.f5.com/csp/article/K46011592?utm_source=f5support&utm_medium=RSS | |
| https://www.debian.org/security/2019/dsa-4520 | |
| https://www.synology.com/security/advisory/Synology_SA_19_33 |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | apache | traffic_server | * |
From (including) 6.0.0 |
Up to (including) 6.2.3 |
||||
| 运行在以下环境 | |||||||||
| 应用 | apache | traffic_server | * |
From (including) 7.0.0 |
Up to (including) 7.1.6 |
||||
| 运行在以下环境 | |||||||||
| 应用 | apache | traffic_server | * |
From (including) 8.0.0 |
Up to (including) 8.0.3 |
||||
| 运行在以下环境 | |||||||||
| 应用 | apple | swiftnio | * |
From (including) 1.0.0 |
Up to (including) 1.4.0 |
||||
| 运行在以下环境 | |||||||||
| 应用 | mcafee | web_gateway | * |
From (including) 7.7.2.0 |
Up to (excluding) 7.7.2.24 |
||||
| 运行在以下环境 | |||||||||
| 应用 | mcafee | web_gateway | * |
From (including) 7.8.2.0 |
Up to (excluding) 7.8.2.13 |
||||
| 运行在以下环境 | |||||||||
| 应用 | mcafee | web_gateway | * |
From (including) 8.1.0 |
Up to (excluding) 8.2.0 |
||||
| 运行在以下环境 | |||||||||
| 应用 | oracle | graalvm | 19.2.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_core_services | 1.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_enterprise_application_platform | 7.2.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_enterprise_application_platform | 7.3.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | openshift_service_mesh | 1.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | quay | 3.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | software_collections | 1.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | synology | diskstation_manager | 6.2 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | synology | skynas | - | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.10 | nodejs | * |
Up to (excluding) 10.16.3-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.11 | nodejs | * |
Up to (excluding) 10.16.3-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.12 | nodejs | * |
Up to (excluding) 10.16.3-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.13 | nodejs | * |
Up to (excluding) 10.16.3-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.14 | netty | * |
Up to (excluding) 10.16.3-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.15 | netty | * |
Up to (excluding) 10.16.3-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.9 | nodejs | * |
Up to (excluding) 10.16.3-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_edge | nodejs | * |
Up to (excluding) 10.16.3-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | apple | mac_os_x | * |
From (including) 10.12 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | canonical | ubuntu_linux | * |
From (including) 14.04 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | canonical | ubuntu_linux | 16.04 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | canonical | ubuntu_linux | 18.04 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | canonical | ubuntu_linux | 19.04 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | centos_8 | netty | * |
Up to (excluding) 10.16.3-2.module+el8.0.0+4214+49953fda |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian | debian_linux | 10.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian | debian_linux | 9.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_10 | nodejs | * |
Up to (excluding) 8.0.2+ds-1+deb10u1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedoraproject | fedora | 29 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedoraproject | fedora | 30 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_29 | nodejs | * |
Up to (excluding) 10.16.3-1.fc29 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_29_Modular | nodejs | * |
Up to (excluding) 10-2920190816104510.6c81f848 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_30 | nodejs | * |
Up to (excluding) 10.16.3-1.fc30 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_30_Modular | nodejs | * |
Up to (excluding) 10-3020190816104510.a5b0195c |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse | leap | 15.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse | leap | 15.1 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.0 | nodejs | * |
Up to (excluding) 8.16.1-lp151.2.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.1 | nodejs | * |
Up to (excluding) 8.16.1-lp151.2.6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle linux_8 | nodejs | * |
Up to (excluding) 1.18.3-1.module+el8.1.0+5392+4d6b561f |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_8 | netty | * |
Up to (excluding) 6.4.1-1.10.14.1.1.module+el8.0.0+5349+4d6b561f |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 8.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_8 | netty | * |
Up to (excluding) 10.16.3-2.module+el8.0.0+4214+49953fda |
|||||
| 运行在以下环境 | |||||||||
| 系统 | sles_12 | nodejs10 | * |
Up to (excluding) 10.16.3-1.12 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | synology | vs960hd_firmware | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | synology | vs960hd | - | - | |||||
- 攻击路径 远程
- 攻击复杂度 复杂
- 权限要求 无需权限
- 影响范围 有限影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 100
还没有评论，来说两句吧...