4521 matches found
Amazon Linux 2 : golang (ALAS-2019-1272) (Ping Flood) (Reset Flood)
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU,...
Apache Tomcat DoS Vulnerability (Jun 2019) - Linux
Apache Tomcat is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"; if...
[SECURITY] Fedora 29 Update: nghttp2-1.39.2-1.fc29
This package contains the HTTP/2 client, server and proxy programs...
Debian DSA-4509-1 : apache2 - security update (Internal Data Buffering)
Several vulnerabilities have been found in the Apache HTTPD server. - CVE-2019-9517 Jonathan Looney reported that a malicious client could perform a denial of service attack exhausting h2 workers by flooding a connection with requests and basically never reading responses on the TCP connection. -...
Debian DSA-4508-1 : h2o - security update (Ping Flood) (Reset Flood) (Settings Flood)
Three vulnerabilities were discovered in the HTTP/2 code of the H2O HTTP server, which could result in denial of service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4508. The text itself is copyright C...
Debian: Security Advisory (DSA-4508-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
nginx 1.9.5 - 1.17.2 HTTP/2 Multiple DoS Vulnerabilities
nginx is prone to multiple denial of service DoS vulnerabilities in the HTTP/2 implementation. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
[ASA-201908-17] libnghttp2: denial of service
Arch Linux Security Advisory ASA-201908-17 ========================================== Severity: Medium Date : 2019-08-27 CVE-ID : CVE-2019-9511 CVE-2019-9513 Package : libnghttp2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1024 Summary ======= The package...
The vulnerability of the HTTP/2 network protocol implementation in Windows operating systems, Nginx servers, and Node.js software platforms allows a attacker to cause a service failure.
The vulnerability of the HTTP/2 network protocol implementation in Windows operating systems, Nginx servers, and Node.js software platforms is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...
FreeBSD : h2o -- multiple HTTP/2 vulnerabilities (73b1e734-c74e-11e9-8052-0028f8d09152) (Ping Flood) (Reset Flood) (Settings Flood)
Jonathon Loomey of Netflix reports : HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion Recently, a series of DoS attack vulnerabilities have been reported on a broad range of HTTP/2 stacks. Among the vulnerabilities, H2O is exposed to the following : -...
openSUSE Security Update : go1.12 (openSUSE-2019-2000) (Ping Flood) (Reset Flood)
This update for go1.12 fixes the following issues : Security issues fixed : - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth. bsc1146111 - CVE-2019-9514: Fixed HTTP/2 implementation is vulnerable to a reset flood, potentially leading to a denial of...
SUSE SLED15 / SLES15 Security Update : go1.11 (SUSE-SU-2019:2213-1) (Ping Flood) (Reset Flood)
This update for go1.11 fixes the following issues : Security issues fixed : CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth bsc1146111. CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of...
FreeBSD : h2o -- multiple HTTP/2 vulnerabilities (72a5579e-c765-11e9-8052-0028f8d09152) (Ping Flood) (Reset Flood) (Settings Flood)
Jonathon Loomey of Netflix reports : HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion Recently, a series of DoS attack vulnerabilities have been reported on a broad range of HTTP/2 stacks. Among the vulnerabilities, H2O is exposed to the following : -...
SUSE SLED15 / SLES15 Security Update : go1.12 (SUSE-SU-2019:2214-1) (Ping Flood) (Reset Flood)
This update for go1.12 fixes the following issues : Security issues fixed : CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth bsc1146111. CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of...
OPENSUSE-SU-2019:2000-1 Security update for go1.12
This update for go1.12 fixes the following issues: Security issues fixed: - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth. bsc1146111 - CVE-2019-9514: Fixed HTTP/2 implementation is vulnerable to a reset flood, potentially leading to a denial of...
Security update for go1.12 (important)
openSUSE Security Update: Security update for go1.12 Announcement ID: openSUSE-SU-2019:2000-1 Rating: important References: 1139210 1141689 1146111 1146115 1146123 Cross-References: CVE-2019-14809 CVE-2019-9512 CVE-2019-9514 Affected Products: openSUSE Leap 15.1 An update that solves three...
[ASA-201908-16] go-pie: multiple issues
Arch Linux Security Advisory ASA-201908-16 ========================================== Severity: Medium Date : 2019-08-24 CVE-ID : CVE-2019-9512 CVE-2019-9514 CVE-2019-14809 Package : go-pie Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1020 Summary ======= The...
[ASA-201908-15] go: multiple issues
Arch Linux Security Advisory ASA-201908-15 ========================================== Severity: Medium Date : 2019-08-24 CVE-ID : CVE-2019-9512 CVE-2019-9514 CVE-2019-14809 Package : go Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1021 Summary ======= The package ...
Debian: Security Advisory (DSA-4505-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...