CVE-2019-9518 | ByteOS Network

Vulnerability Details :

CVE-2019-9518

Assigner-certcc

Assigner Org ID-37e5125f-f79b-445b-8fad-9564f167944b

Published At-13 Aug, 2019 | 20:50

Updated At-04 Aug, 2024 | 21:54

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:certcc

Assigner Org ID:37e5125f-f79b-445b-8fad-9564f167944b

Published At:13 Aug, 2019 | 20:50

Updated At:04 Aug, 2024 | 21:54

▼CVE Numbering Authority (CNA)

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.

Affected Products

Vendor

Product

Versions

Affected

n/a

Problem Types

Type	CWE ID	Description
CWE	CWE-400	CWE-400 Uncontrolled Resource Consumption

Type: CWE

CWE ID: CWE-400

Description: CWE-400 Uncontrolled Resource Consumption

Metrics

Version	Base score	Base severity	Vector
3.0	7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Version: 3.0

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Credits

Thanks to Piotr Sikora of Google for reporting this vulnerability.

References

Hyperlink	Resource
https://kb.cert.org/vuls/id/605641/	third-party-advisory x_refsource_CERT-VN
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md	x_refsource_MISC
https://seclists.org/bugtraq/2019/Aug/24	mailing-list x_refsource_BUGTRAQ
http://seclists.org/fulldisclosure/2019/Aug/16	mailing-list x_refsource_FULLDISC
https://www.synology.com/security/advisory/Synology_SA_19_33	x_refsource_CONFIRM
https://support.f5.com/csp/article/K46011592	x_refsource_CONFIRM
https://lists.apache.org/thread.html/2653c56545573b528f3f6352a29eccaf498bd6fb2a6a59568d81a61d%40%3Cannounce.trafficserver.apache.org%3E	mailing-list x_refsource_MLIST
https://lists.apache.org/thread.html/091b518265bce56a16af87b77c8cfacda902a02079e866f9fdf13b61%40%3Cusers.trafficserver.apache.org%3E	mailing-list x_refsource_MLIST
https://lists.apache.org/thread.html/ff5b0821a6985159a832ff6d1a4bd311ac07ecc7db1e2d8bab619107%40%3Cdev.trafficserver.apache.org%3E	mailing-list x_refsource_MLIST
https://security.netapp.com/advisory/ntap-20190823-0005/	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/	vendor-advisory x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/	vendor-advisory x_refsource_FEDORA
https://www.debian.org/security/2019/dsa-4520	vendor-advisory x_refsource_DEBIAN
https://seclists.org/bugtraq/2019/Sep/18	mailing-list x_refsource_BUGTRAQ
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html	vendor-advisory x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html	vendor-advisory x_refsource_SUSE
https://kc.mcafee.com/corporate/index?page=content&id=SB10296	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2019:2925	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2939	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2955	vendor-advisory x_refsource_REDHAT
https://support.f5.com/csp/article/K46011592?utm_source=f5support&amp%3Butm_medium=RSS	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2019:3892	vendor-advisory x_refsource_REDHAT
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E	mailing-list x_refsource_MLIST
https://access.redhat.com/errata/RHSA-2019:4352	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0727	vendor-advisory x_refsource_REDHAT
https://lists.apache.org/thread.html/r99a625fb17032646d96cd23dec49603ff630e9318e44a686d63046bc%40%3Ccommits.cassandra.apache.org%3E	mailing-list x_refsource_MLIST
https://lists.apache.org/thread.html/rd31230d01fa6aad18bdadc0720acd1747e53690bd35f73a48e7a9b75%40%3Ccommits.cassandra.apache.org%3E	mailing-list x_refsource_MLIST

Hyperlink: https://kb.cert.org/vuls/id/605641/

Resource:

third-party-advisory

x_refsource_CERT-VN

Hyperlink: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

Resource:

x_refsource_MISC

Hyperlink: https://seclists.org/bugtraq/2019/Aug/24

Resource:

mailing-list

x_refsource_BUGTRAQ

Hyperlink: http://seclists.org/fulldisclosure/2019/Aug/16

Resource:

mailing-list

x_refsource_FULLDISC

Hyperlink: https://www.synology.com/security/advisory/Synology_SA_19_33

Resource:

x_refsource_CONFIRM

Hyperlink: https://support.f5.com/csp/article/K46011592

Resource:

x_refsource_CONFIRM

Hyperlink: https://lists.apache.org/thread.html/2653c56545573b528f3f6352a29eccaf498bd6fb2a6a59568d81a61d%40%3Cannounce.trafficserver.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://lists.apache.org/thread.html/091b518265bce56a16af87b77c8cfacda902a02079e866f9fdf13b61%40%3Cusers.trafficserver.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://lists.apache.org/thread.html/ff5b0821a6985159a832ff6d1a4bd311ac07ecc7db1e2d8bab619107%40%3Cdev.trafficserver.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://security.netapp.com/advisory/ntap-20190823-0005/

Resource:

x_refsource_CONFIRM

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/

Resource:

vendor-advisory

x_refsource_FEDORA

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/

Resource:

vendor-advisory

x_refsource_FEDORA

Hyperlink: https://www.debian.org/security/2019/dsa-4520

Resource:

vendor-advisory

x_refsource_DEBIAN

Hyperlink: https://seclists.org/bugtraq/2019/Sep/18

Resource:

mailing-list

x_refsource_BUGTRAQ

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: https://kc.mcafee.com/corporate/index?page=content&id=SB10296

Resource:

x_refsource_CONFIRM

Hyperlink: https://access.redhat.com/errata/RHSA-2019:2925

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://access.redhat.com/errata/RHSA-2019:2939

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://access.redhat.com/errata/RHSA-2019:2955

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://support.f5.com/csp/article/K46011592?utm_source=f5support&amp%3Butm_medium=RSS

Resource:

x_refsource_CONFIRM

Hyperlink: https://access.redhat.com/errata/RHSA-2019:3892

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://access.redhat.com/errata/RHSA-2019:4352

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://access.redhat.com/errata/RHSA-2020:0727

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://lists.apache.org/thread.html/r99a625fb17032646d96cd23dec49603ff630e9318e44a686d63046bc%40%3Ccommits.cassandra.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://lists.apache.org/thread.html/rd31230d01fa6aad18bdadc0720acd1747e53690bd35f73a48e7a9b75%40%3Ccommits.cassandra.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://kb.cert.org/vuls/id/605641/	third-party-advisory x_refsource_CERT-VN x_transferred
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md	x_refsource_MISC x_transferred
https://seclists.org/bugtraq/2019/Aug/24	mailing-list x_refsource_BUGTRAQ x_transferred
http://seclists.org/fulldisclosure/2019/Aug/16	mailing-list x_refsource_FULLDISC x_transferred
https://www.synology.com/security/advisory/Synology_SA_19_33	x_refsource_CONFIRM x_transferred
https://support.f5.com/csp/article/K46011592	x_refsource_CONFIRM x_transferred
https://lists.apache.org/thread.html/2653c56545573b528f3f6352a29eccaf498bd6fb2a6a59568d81a61d%40%3Cannounce.trafficserver.apache.org%3E	mailing-list x_refsource_MLIST x_transferred
https://lists.apache.org/thread.html/091b518265bce56a16af87b77c8cfacda902a02079e866f9fdf13b61%40%3Cusers.trafficserver.apache.org%3E	mailing-list x_refsource_MLIST x_transferred
https://lists.apache.org/thread.html/ff5b0821a6985159a832ff6d1a4bd311ac07ecc7db1e2d8bab619107%40%3Cdev.trafficserver.apache.org%3E	mailing-list x_refsource_MLIST x_transferred
https://security.netapp.com/advisory/ntap-20190823-0005/	x_refsource_CONFIRM x_transferred
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/	vendor-advisory x_refsource_FEDORA x_transferred
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/	vendor-advisory x_refsource_FEDORA x_transferred
https://www.debian.org/security/2019/dsa-4520	vendor-advisory x_refsource_DEBIAN x_transferred
https://seclists.org/bugtraq/2019/Sep/18	mailing-list x_refsource_BUGTRAQ x_transferred
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html	vendor-advisory x_refsource_SUSE x_transferred
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html	vendor-advisory x_refsource_SUSE x_transferred
https://kc.mcafee.com/corporate/index?page=content&id=SB10296	x_refsource_CONFIRM x_transferred
https://access.redhat.com/errata/RHSA-2019:2925	vendor-advisory x_refsource_REDHAT x_transferred
https://access.redhat.com/errata/RHSA-2019:2939	vendor-advisory x_refsource_REDHAT x_transferred
https://access.redhat.com/errata/RHSA-2019:2955	vendor-advisory x_refsource_REDHAT x_transferred
https://support.f5.com/csp/article/K46011592?utm_source=f5support&amp%3Butm_medium=RSS	x_refsource_CONFIRM x_transferred
https://access.redhat.com/errata/RHSA-2019:3892	vendor-advisory x_refsource_REDHAT x_transferred
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E	mailing-list x_refsource_MLIST x_transferred
https://access.redhat.com/errata/RHSA-2019:4352	vendor-advisory x_refsource_REDHAT x_transferred
https://access.redhat.com/errata/RHSA-2020:0727	vendor-advisory x_refsource_REDHAT x_transferred
https://lists.apache.org/thread.html/r99a625fb17032646d96cd23dec49603ff630e9318e44a686d63046bc%40%3Ccommits.cassandra.apache.org%3E	mailing-list x_refsource_MLIST x_transferred
https://lists.apache.org/thread.html/rd31230d01fa6aad18bdadc0720acd1747e53690bd35f73a48e7a9b75%40%3Ccommits.cassandra.apache.org%3E	mailing-list x_refsource_MLIST x_transferred

Hyperlink: https://kb.cert.org/vuls/id/605641/

Resource:

third-party-advisory

x_refsource_CERT-VN

x_transferred

Hyperlink: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://seclists.org/bugtraq/2019/Aug/24

Resource:

mailing-list

x_refsource_BUGTRAQ

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2019/Aug/16

Resource:

mailing-list

x_refsource_FULLDISC

x_transferred

Hyperlink: https://www.synology.com/security/advisory/Synology_SA_19_33

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://support.f5.com/csp/article/K46011592

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://lists.apache.org/thread.html/2653c56545573b528f3f6352a29eccaf498bd6fb2a6a59568d81a61d%40%3Cannounce.trafficserver.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

x_transferred

Hyperlink: https://lists.apache.org/thread.html/091b518265bce56a16af87b77c8cfacda902a02079e866f9fdf13b61%40%3Cusers.trafficserver.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

x_transferred

Hyperlink: https://lists.apache.org/thread.html/ff5b0821a6985159a832ff6d1a4bd311ac07ecc7db1e2d8bab619107%40%3Cdev.trafficserver.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

x_transferred

Hyperlink: https://security.netapp.com/advisory/ntap-20190823-0005/

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/

Resource:

vendor-advisory

x_refsource_FEDORA

x_transferred

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/

Resource:

vendor-advisory

x_refsource_FEDORA

x_transferred

Hyperlink: https://www.debian.org/security/2019/dsa-4520

Resource:

vendor-advisory

x_refsource_DEBIAN

x_transferred

Hyperlink: https://seclists.org/bugtraq/2019/Sep/18

Resource:

mailing-list

x_refsource_BUGTRAQ

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: https://kc.mcafee.com/corporate/index?page=content&id=SB10296

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2019:2925

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2019:2939

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2019:2955

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://support.f5.com/csp/article/K46011592?utm_source=f5support&amp%3Butm_medium=RSS

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2019:3892

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2019:4352

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2020:0727

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://lists.apache.org/thread.html/r99a625fb17032646d96cd23dec49603ff630e9318e44a686d63046bc%40%3Ccommits.cassandra.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

x_transferred

Hyperlink: https://lists.apache.org/thread.html/rd31230d01fa6aad18bdadc0720acd1747e53690bd35f73a48e7a9b75%40%3Ccommits.cassandra.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

x_transferred

▼National Vulnerability Database (NVD)

Source:cret@cert.org

Published At:13 Aug, 2019 | 21:15

Updated At:14 Jan, 2025 | 19:29

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Secondary	3.0	7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary	2.0	7.8	HIGH	AV:N/AC:L/Au:N/C:N/I:N/A:C

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Type: Secondary

Version: 3.0

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Type: Primary

Version: 2.0

Base score: 7.8

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:N/I:N/A:C

CPE Matches

>>swiftnio>>Versions from 1.0.0(inclusive) to 1.4.0(inclusive)

cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:*

>>mac_os_x>>Versions from 10.12(inclusive)

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

>>ubuntu_linux>>Versions from 14.04(inclusive)

cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*

The Apache Software Foundation

>>traffic_server>>Versions from 6.0.0(inclusive) to 6.2.3(inclusive)

cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*

The Apache Software Foundation

>>traffic_server>>Versions from 7.0.0(inclusive) to 7.1.6(inclusive)

cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*

The Apache Software Foundation

>>traffic_server>>Versions from 8.0.0(inclusive) to 8.0.3(inclusive)

cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*

>>ubuntu_linux>>16.04

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

>>ubuntu_linux>>18.04

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

>>ubuntu_linux>>19.04

cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>9.0

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>10.0

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:a:synology:skynas:-:*:*:*:*:*:*:*

>>diskstation_manager>>6.2

cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:*

>>vs960hd_firmware>>-

cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:*

>>fedora>>29

cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*

>>fedora>>30

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

>>leap>>15.0

cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*

>>leap>>15.1

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

>>jboss_core_services>>1.0

cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:*

>>jboss_enterprise_application_platform>>7.2.0

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*

>>jboss_enterprise_application_platform>>7.3.0

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:*

>>openshift_service_mesh>>1.0

cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:*

>>quay>>3.0.0

cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*

>>software_collections>>1.0

cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*

>>enterprise_linux>>8.0

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Oracle Corporation

>>graalvm>>19.2.0

cpe:2.3:a:oracle:graalvm:19.2.0:*:*:*:enterprise:*:*:*

>>web_gateway>>Versions from 7.7.2.0(inclusive) to 7.7.2.24(exclusive)

cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*

>>web_gateway>>Versions from 7.8.2.0(inclusive) to 7.8.2.13(exclusive)

cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*

>>web_gateway>>Versions from 8.1.0(inclusive) to 8.2.0(exclusive)

cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 8.0.0(inclusive) to 8.8.1(inclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 8.9.0(inclusive) to 8.16.1(exclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 10.0.0(inclusive) to 10.12.0(inclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 10.13.0(inclusive) to 10.16.3(exclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 12.0.0(inclusive) to 12.8.1(exclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-400	Secondary	cret@cert.org
CWE-770	Primary	nvd@nist.gov

CWE ID: CWE-400

Type: Secondary

Source: cret@cert.org

CWE ID: CWE-770

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html	cret@cert.org	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html	cret@cert.org	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2019/Aug/16	cret@cert.org	Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2925	cret@cert.org	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2939	cret@cert.org	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2955	cret@cert.org	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3892	cret@cert.org	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4352	cret@cert.org	Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0727	cret@cert.org	Third Party Advisory
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md	cret@cert.org	Third Party Advisory
https://kb.cert.org/vuls/id/605641/	cret@cert.org	Third Party Advisory US Government Resource
https://kc.mcafee.com/corporate/index?page=content&id=SB10296	cret@cert.org	Third Party Advisory
https://lists.apache.org/thread.html/091b518265bce56a16af87b77c8cfacda902a02079e866f9fdf13b61%40%3Cusers.trafficserver.apache.org%3E	cret@cert.org	N/A
https://lists.apache.org/thread.html/2653c56545573b528f3f6352a29eccaf498bd6fb2a6a59568d81a61d%40%3Cannounce.trafficserver.apache.org%3E	cret@cert.org	N/A
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E	cret@cert.org	N/A
https://lists.apache.org/thread.html/ff5b0821a6985159a832ff6d1a4bd311ac07ecc7db1e2d8bab619107%40%3Cdev.trafficserver.apache.org%3E	cret@cert.org	N/A
https://lists.apache.org/thread.html/r99a625fb17032646d96cd23dec49603ff630e9318e44a686d63046bc%40%3Ccommits.cassandra.apache.org%3E	cret@cert.org	N/A
https://lists.apache.org/thread.html/rd31230d01fa6aad18bdadc0720acd1747e53690bd35f73a48e7a9b75%40%3Ccommits.cassandra.apache.org%3E	cret@cert.org	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/	cret@cert.org	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/	cret@cert.org	N/A
https://seclists.org/bugtraq/2019/Aug/24	cret@cert.org	Mailing List Third Party Advisory
https://seclists.org/bugtraq/2019/Sep/18	cret@cert.org	Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20190823-0005/	cret@cert.org	Third Party Advisory
https://support.f5.com/csp/article/K46011592	cret@cert.org	Third Party Advisory
https://support.f5.com/csp/article/K46011592?utm_source=f5support&amp%3Butm_medium=RSS	cret@cert.org	N/A
https://www.debian.org/security/2019/dsa-4520	cret@cert.org	Third Party Advisory
https://www.synology.com/security/advisory/Synology_SA_19_33	cret@cert.org	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2019/Aug/16	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2925	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2939	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2955	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3892	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4352	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0727	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://kb.cert.org/vuls/id/605641/	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory US Government Resource
https://kc.mcafee.com/corporate/index?page=content&id=SB10296	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://lists.apache.org/thread.html/091b518265bce56a16af87b77c8cfacda902a02079e866f9fdf13b61%40%3Cusers.trafficserver.apache.org%3E	af854a3a-2127-422b-91ae-364da2661108	N/A
https://lists.apache.org/thread.html/2653c56545573b528f3f6352a29eccaf498bd6fb2a6a59568d81a61d%40%3Cannounce.trafficserver.apache.org%3E	af854a3a-2127-422b-91ae-364da2661108	N/A
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E	af854a3a-2127-422b-91ae-364da2661108	N/A
https://lists.apache.org/thread.html/ff5b0821a6985159a832ff6d1a4bd311ac07ecc7db1e2d8bab619107%40%3Cdev.trafficserver.apache.org%3E	af854a3a-2127-422b-91ae-364da2661108	N/A
https://lists.apache.org/thread.html/r99a625fb17032646d96cd23dec49603ff630e9318e44a686d63046bc%40%3Ccommits.cassandra.apache.org%3E	af854a3a-2127-422b-91ae-364da2661108	N/A
https://lists.apache.org/thread.html/rd31230d01fa6aad18bdadc0720acd1747e53690bd35f73a48e7a9b75%40%3Ccommits.cassandra.apache.org%3E	af854a3a-2127-422b-91ae-364da2661108	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/	af854a3a-2127-422b-91ae-364da2661108	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/	af854a3a-2127-422b-91ae-364da2661108	N/A
https://seclists.org/bugtraq/2019/Aug/24	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
https://seclists.org/bugtraq/2019/Sep/18	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20190823-0005/	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://support.f5.com/csp/article/K46011592	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://support.f5.com/csp/article/K46011592?utm_source=f5support&amp%3Butm_medium=RSS	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.debian.org/security/2019/dsa-4520	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://www.synology.com/security/advisory/Synology_SA_19_33	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html

Source: cret@cert.org

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html

Source: cret@cert.org

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://seclists.org/fulldisclosure/2019/Aug/16

Source: cret@cert.org

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2019:2925

Source: cret@cert.org

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2019:2939

Source: cret@cert.org

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2019:2955

Source: cret@cert.org

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2019:3892

Source: cret@cert.org

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2019:4352

Source: cret@cert.org

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2020:0727

Source: cret@cert.org

Resource:

Third Party Advisory

Hyperlink: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

Source: cret@cert.org

Resource:

Third Party Advisory

Hyperlink: https://kb.cert.org/vuls/id/605641/

Source: cret@cert.org

Resource:

Third Party Advisory

US Government Resource

Hyperlink: https://kc.mcafee.com/corporate/index?page=content&id=SB10296

Source: cret@cert.org

Resource:

Third Party Advisory

Hyperlink: https://lists.apache.org/thread.html/091b518265bce56a16af87b77c8cfacda902a02079e866f9fdf13b61%40%3Cusers.trafficserver.apache.org%3E

Source: cret@cert.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/2653c56545573b528f3f6352a29eccaf498bd6fb2a6a59568d81a61d%40%3Cannounce.trafficserver.apache.org%3E

Source: cret@cert.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E

Source: cret@cert.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/ff5b0821a6985159a832ff6d1a4bd311ac07ecc7db1e2d8bab619107%40%3Cdev.trafficserver.apache.org%3E

Source: cret@cert.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/r99a625fb17032646d96cd23dec49603ff630e9318e44a686d63046bc%40%3Ccommits.cassandra.apache.org%3E

Source: cret@cert.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/rd31230d01fa6aad18bdadc0720acd1747e53690bd35f73a48e7a9b75%40%3Ccommits.cassandra.apache.org%3E

Source: cret@cert.org

Resource: N/A

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/

Source: cret@cert.org

Resource: N/A

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/

Source: cret@cert.org

Resource: N/A

Hyperlink: https://seclists.org/bugtraq/2019/Aug/24

Source: cret@cert.org

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://seclists.org/bugtraq/2019/Sep/18

Source: cret@cert.org

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20190823-0005/

Source: cret@cert.org

Resource:

Third Party Advisory

Hyperlink: https://support.f5.com/csp/article/K46011592

Source: cret@cert.org

Resource:

Third Party Advisory

Hyperlink: https://support.f5.com/csp/article/K46011592?utm_source=f5support&amp%3Butm_medium=RSS

Source: cret@cert.org

Resource: N/A

Hyperlink: https://www.debian.org/security/2019/dsa-4520

Source: cret@cert.org

Resource:

Third Party Advisory

Hyperlink: https://www.synology.com/security/advisory/Synology_SA_19_33

Source: cret@cert.org

Resource:

Third Party Advisory

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://seclists.org/fulldisclosure/2019/Aug/16

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2019:2925

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2019:2939

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2019:2955

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2019:3892

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2019:4352

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2020:0727

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://kb.cert.org/vuls/id/605641/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

US Government Resource

Hyperlink: https://kc.mcafee.com/corporate/index?page=content&id=SB10296

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://lists.apache.org/thread.html/091b518265bce56a16af87b77c8cfacda902a02079e866f9fdf13b61%40%3Cusers.trafficserver.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/2653c56545573b528f3f6352a29eccaf498bd6fb2a6a59568d81a61d%40%3Cannounce.trafficserver.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/ff5b0821a6985159a832ff6d1a4bd311ac07ecc7db1e2d8bab619107%40%3Cdev.trafficserver.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/r99a625fb17032646d96cd23dec49603ff630e9318e44a686d63046bc%40%3Ccommits.cassandra.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/rd31230d01fa6aad18bdadc0720acd1747e53690bd35f73a48e7a9b75%40%3Ccommits.cassandra.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://seclists.org/bugtraq/2019/Aug/24

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://seclists.org/bugtraq/2019/Sep/18

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20190823-0005/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://support.f5.com/csp/article/K46011592

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://support.f5.com/csp/article/K46011592?utm_source=f5support&amp%3Butm_medium=RSS

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://www.debian.org/security/2019/dsa-4520

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://www.synology.com/security/advisory/Synology_SA_19_33

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory