vulnerability
Microsoft Windows: CVE-2019-9513: HTTP/2 Server Denial of Service Vulnerability
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:N/C:N/I:N/A:C) | Aug 13, 2019 | Aug 13, 2019 | Aug 7, 2024 |
Severity
8
CVSS
(AV:N/AC:L/Au:N/C:N/I:N/A:C)
Published
Aug 13, 2019
Added
Aug 13, 2019
Modified
Aug 7, 2024
Description
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
Solution(s)
microsoft-windows-windows_10-1507-kb4512497microsoft-windows-windows_10-1607-kb4512517microsoft-windows-windows_10-1703-kb4512507microsoft-windows-windows_10-1709-kb4512516microsoft-windows-windows_10-1803-kb4512501microsoft-windows-windows_10-1809-kb4511553microsoft-windows-windows_10-1903-kb4512508microsoft-windows-windows_server_2016-1607-kb4512517microsoft-windows-windows_server_2019-1809-kb4511553msft-kb4512508-35cff443-e9f5-4d0a-a8fc-7fe8a39ab515
References
- CERT-VN-605641
- CVE-2019-9513
- https://attackerkb.com/topics/CVE-2019-9513
- DEBIAN-DSA-4505
- DEBIAN-DSA-4511
- DEBIAN-DSA-4669
- REDHAT-RHSA-2019:2692
- REDHAT-RHSA-2019:2745
- REDHAT-RHSA-2019:2746
- REDHAT-RHSA-2019:2775
- REDHAT-RHSA-2019:2799
- REDHAT-RHSA-2019:2925
- REDHAT-RHSA-2019:2939
- REDHAT-RHSA-2019:2949
- REDHAT-RHSA-2019:2955
- REDHAT-RHSA-2019:2966
- REDHAT-RHSA-2019:3041
- REDHAT-RHSA-2019:3932
- REDHAT-RHSA-2019:3933
- REDHAT-RHSA-2019:3935
- URL-https://support.microsoft.com/help/4511553
- URL-https://support.microsoft.com/help/4512497
- URL-https://support.microsoft.com/help/4512501
- URL-https://support.microsoft.com/help/4512507
- URL-https://support.microsoft.com/help/4512508
- URL-https://support.microsoft.com/help/4512516
- URL-https://support.microsoft.com/help/4512517
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.