CVE编号
CVE-2019-9511利用情况
暂无补丁情况
官方补丁披露时间
2019-08-13漏洞描述
某些HTTP / 2实现易受窗口大小操纵和流优先级操纵的影响，有可能导致拒绝服务。攻击者通过多个流从指定的资源请求大量数据。他们操纵窗口大小和流优先级，以强制服务器将数据按1字节的块排队。根据此数据排队的效率，这可能会消耗过多的CPU和/或内存。解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接 |
|
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html | |
| http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html | |
| http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html | |
| http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.html | |
| http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.html | |
| http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html | |
| https://access.redhat.com/errata/RHSA-2019:2692 | |
| https://access.redhat.com/errata/RHSA-2019:2745 | |
| https://access.redhat.com/errata/RHSA-2019:2746 | |
| https://access.redhat.com/errata/RHSA-2019:2775 | |
| https://access.redhat.com/errata/RHSA-2019:2799 | |
| https://access.redhat.com/errata/RHSA-2019:2925 | |
| https://access.redhat.com/errata/RHSA-2019:2939 | |
| https://access.redhat.com/errata/RHSA-2019:2949 | |
| https://access.redhat.com/errata/RHSA-2019:2955 | |
| https://access.redhat.com/errata/RHSA-2019:2966 | |
| https://access.redhat.com/errata/RHSA-2019:3041 | |
| https://access.redhat.com/errata/RHSA-2019:3932 | |
| https://access.redhat.com/errata/RHSA-2019:3933 | |
| https://access.redhat.com/errata/RHSA-2019:3935 | |
| https://access.redhat.com/errata/RHSA-2019:4018 | |
| https://access.redhat.com/errata/RHSA-2019:4019 | |
| https://access.redhat.com/errata/RHSA-2019:4020 | |
| https://access.redhat.com/errata/RHSA-2019:4021 | |
| https://github.com/Netflix/security-bulletins/blob/master/advisories/third-pa... | |
| https://kb.cert.org/vuls/id/605641/ | |
| https://kc.mcafee.com/corporate/index?page=content&id=SB10296 | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-9511 | |
| https://seclists.org/bugtraq/2019/Aug/40 | |
| https://seclists.org/bugtraq/2019/Sep/1 | |
| https://security.netapp.com/advisory/ntap-20190823-0002/ | |
| https://security.netapp.com/advisory/ntap-20190823-0005/ | |
| https://support.f5.com/csp/article/K02591030 | |
| https://support.f5.com/csp/article/K02591030?utm_source=f5support&utm_medium=RSS | |
| https://usn.ubuntu.com/4099-1/ | |
| https://www.debian.org/security/2019/dsa-4505 | |
| https://www.debian.org/security/2019/dsa-4511 | |
| https://www.debian.org/security/2020/dsa-4669 | |
| https://www.oracle.com/security-alerts/cpujan2021.html | |
| https://www.oracle.com/security-alerts/cpuoct2020.html | |
| https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html | |
| https://www.synology.com/security/advisory/Synology_SA_19_33 |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | apache | traffic_server | * |
From (including) 6.0.0 |
Up to (including) 6.2.3 |
||||
| 运行在以下环境 | |||||||||
| 应用 | apache | traffic_server | * |
From (including) 7.0.0 |
Up to (including) 7.1.6 |
||||
| 运行在以下环境 | |||||||||
| 应用 | apache | traffic_server | * |
From (including) 8.0.0 |
Up to (including) 8.0.3 |
||||
| 运行在以下环境 | |||||||||
| 应用 | apple | swiftnio | * |
From (including) 1.0.0 |
Up to (including) 1.4.0 |
||||
| 运行在以下环境 | |||||||||
| 应用 | mcafee | web_gateway | * |
From (including) 7.7.2.0 |
Up to (excluding) 7.7.2.24 |
||||
| 运行在以下环境 | |||||||||
| 应用 | mcafee | web_gateway | * |
From (including) 7.8.2.0 |
Up to (excluding) 7.8.2.13 |
||||
| 运行在以下环境 | |||||||||
| 应用 | mcafee | web_gateway | * |
From (including) 8.1.0 |
Up to (excluding) 8.2.0 |
||||
| 运行在以下环境 | |||||||||
| 应用 | nginx | nginx | * |
From (including) 1.17.0 |
Up to (including) 1.17.2 |
||||
| 运行在以下环境 | |||||||||
| 应用 | nginx | nginx | * |
From (including) 1.9.5 |
Up to (excluding) 1.16.1 |
||||
| 运行在以下环境 | |||||||||
| 应用 | oracle | graalvm | 19.2.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_core_services | 1.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_enterprise_application_platform | 7.2.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_enterprise_application_platform | 7.3.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | openshift_service_mesh | 1.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | quay | 3.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | software_collections | 1.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | synology | diskstation_manager | 6.2 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | synology | skynas | - | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.10 | nginx | * |
Up to (excluding) 10.16.3-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.11 | nginx | * |
Up to (excluding) 10.16.3-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.12 | nginx | * |
Up to (excluding) 10.16.3-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.13 | nginx | * |
Up to (excluding) 1.39.2-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.14 | nginx | * |
Up to (excluding) 1.39.2-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.15 | nginx | * |
Up to (excluding) 10.16.3-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.7 | nginx | * |
Up to (excluding) 1.39.2-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.8 | nginx | * |
Up to (excluding) 1.14.1-r1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.9 | nginx | * |
Up to (excluding) 10.16.3-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_edge | nginx | * |
Up to (excluding) 1.39.2-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon linux_2 | nginx | * |
Up to (excluding) 1.39.2-1.amzn2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon linux_AMI | nginx | * |
Up to (excluding) 1.16.1-1.37.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_2 | nginx | * |
Up to (excluding) 1.39.2-1.amzn2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_AMI | nginx | * |
Up to (excluding) 1.16.1-1.37.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | apple | mac_os_x | * |
From (including) 10.12 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | canonical | ubuntu_linux | * |
From (including) 14.04 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | canonical | ubuntu_linux | 16.04 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | canonical | ubuntu_linux | 18.04 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | canonical | ubuntu_linux | 19.04 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | centos_8 | nginx | * |
Up to (excluding) 1.33.0-1.el8_0.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian | debian_linux | 10.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian | debian_linux | 9.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_10 | nginx | * |
Up to (excluding) 1.36.0-2+deb10u1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_9 | nginx | * |
Up to (excluding) 1.18.1-1+deb9u1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedoraproject | fedora | 29 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedoraproject | fedora | 30 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_29 | nginx | * |
Up to (excluding) 1.15.3-2.fc29 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_29_Modular | nginx | * |
Up to (excluding) mainline-2920190816153353.6c81f848 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_30 | nginx | * |
Up to (excluding) 1.15.3-2.fc30 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_30_Modular | nginx | * |
Up to (excluding) mainline-3020190816153353.a5b0195c |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_EPEL_7 | nginx | * |
Up to (excluding) 1.31.1-2.el7 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse | leap | 15.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse | leap | 15.1 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.0 | nginx | * |
Up to (excluding) 1.14.2-lp150.2.11.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.1 | nginx | * |
Up to (excluding) 1.14.2-lp151.4.3.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle linux_7 | nginx | * |
Up to (excluding) 1.17.7-2.el7 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle linux_8 | nginx | * |
Up to (excluding) 1.33.0-3.el8_2.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_7 | nginx | * |
Up to (excluding) 1.0.8-2.el7 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_8 | nginx | * |
Up to (excluding) 1.33.0-1.el8_0.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 8.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_8 | nginx | * |
Up to (excluding) 1.33.0-1.el8_0.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | sles_12 | nodejs10 | * |
Up to (excluding) 10.16.3-1.12 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | sles_12_SP5 | nginx | * |
Up to (excluding) 1.39.2-3.5.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP5 | nginx | * |
Up to (excluding) 14-1.39.2-3.5.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | synology | vs960hd_firmware | - | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_16.04 | nginx | * |
Up to (excluding) 1.10.3-0ubuntu0.16.04.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_16.04_lts | nginx | * |
Up to (excluding) 1.10.3-0ubuntu0.16.04.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04 | nginx | * |
Up to (excluding) 1.14.0-0ubuntu1.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04_lts | nginx | * |
Up to (excluding) 1.14.0-0ubuntu1.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_20.04 | nginx | * |
Up to (excluding) 1.16.1-0ubuntu1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_21.04 | nginx | * |
Up to (excluding) 1.16.1-0ubuntu1 |
|||||
| 运行在以下环境 | |||||||||
| 硬件 | synology | vs960hd | - | - | |||||
- 攻击路径 远程
- 攻击复杂度 复杂
- 权限要求 无需权限
- 影响范围 有限影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 100
还没有评论，来说两句吧...