This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-9511 →

DEBIAN-CVE-2019-9511

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of serv...

Original description

The description as published by the source.

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 nghttp2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-1"}]}]

Debian:13 nghttp2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-1"}]}]

Debian:14 nghttp2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-1"}]}]

Debian:12 nginx

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-3"}]}]

Debian:13 nginx

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-3"}]}]

Debian:14 nginx

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-3"}]}]

Debian:12 nodejs

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3~dfsg-1"}]}]

Debian:13 nodejs

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3~dfsg-1"}]}]

Debian:14 nodejs

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3~dfsg-1"}]}]

References

advisory security-tracker.debian.org