The vulnerability relates to the implementation of the HTTP/2 network protocol on Windows operating systems, Apache Traffic Server web servers, H2O web servers, network programming tools such as netty, SwiftNIO, Envoy, and the Node.js software platform. This allows attackers to induce service failures.

🗓️ 27 Aug 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Flaw in Hypertext Transfer Protocol version two implementation enables remote service disruption via uncontrolled resource consumption.

Reporter	Title	Published	Views	Family All 503
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and IBM Business Process Manager (BPM)	14 Sep 202215:02	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in HTTP/2 implementation used by Watson Knowledge Catalog for IBM Cloud Pak for Data	11 Mar 202015:28	–	ibm
IBM Security Bulletins	Security Bulletin: WebSphere Liberty susceptible to HTTP2 implementation vulnerabilities	26 Mar 202012:19	–	ibm
IBM Security Bulletins	Security Bulletin: Rational Asset Analyzer (RAA) is affected by several WebSphere Application Server vulnerabilities.	31 Jan 202017:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go	29 Aug 202008:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect is vulnerable to denial of service attacks via HTTP/2.	2 Jan 202017:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in netty affect IBM Operations Analytics Predictive Insights (CVE-2019-9514, CVE-2019-9512, CVE-2019-9518, CVE-2019-9515)	28 Feb 202017:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud App Management	24 Oct 201911:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM WebSphere Application Server Liberty affect IBM License Key Server Administration & Reporting Tool and Agent	21 Dec 201905:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Liberty affect IBM WIoTP MessageGateway	3 Jan 202021:21	–	ibm

Vulners

Node

node.js node.jsRange<8.16.1

node.js node.jsRange<10.16.3

node.js node.jsRange<12.8.1

apple swiftnioRange<1.5.0

apache nettyRange<4.1.39.final

apache traffic_serverRange6.0.0–6.2.3

apache traffic_serverRange7.0.0–7.1.6

apache traffic_serverRange8.0.0–8.0.3

Source	Link
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-9512
lists	www.lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19@%3Cannounce.trafficserver.apache.org%3E
lists	www.lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04@%3Cusers.trafficserver.apache.org%3E
lists	www.lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7@%3Cdev.trafficserver.apache.org%3E
blog	www.blog.kazuhooku.com/2019/08/h2o-version-226-230-beta2-released.html
netty	www.netty.io/news/2019/08/13/4-1-39-Final.html
support	www.support.apple.com/en-us/HT210436
blog	www.blog.getambassador.io/multiple-http-2-vulnerabilities-in-envoy-proxy-59351babb3aa
nodejs	www.nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2019-9514

16 Sep 2024 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 37.5

CVSS 27.8

EPSS0.83433