Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP3 security update

Fixed packages 26

Vulnerabilities 4

• High 7.5
  CVE-2019-9511 Public exploit EPSS 60%

  Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

  Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manip…

  nodejs nodejs nodejs nginx Debian Ubuntu Alpine
  Aug 13, 2019
• High 7.5
  CVE-2019-9513 Public exploit EPSS 82%

  Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service

  Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority…

  nodejs nodejs nodejs nginx Debian Ubuntu Alpine
  Aug 13, 2019
• High 7.5
  CVE-2019-9516 EPSS 57%

  Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service

  Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. S…

  nodejs nginx nginx nginx Debian Ubuntu Alpine
  Aug 13, 2019
• High 7.5
  CVE-2019-9517 EPSS 27%

  Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

  Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer…

  apache2 apache2 nodejs apache2 Debian Ubuntu Alpine
  Aug 13, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1741864
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1741868
• article
  https://issues.redhat.com/browse/JBCS-826
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2946.json
• report
  https://access.redhat.com/security/cve/CVE-2019-9511
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1741860
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9511
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9511
• article
  https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
• article
  https://kb.cert.org/vuls/id/605641/
• article
  https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
• article
  https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
• report
  https://access.redhat.com/security/cve/CVE-2019-9513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1735741
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9513
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9513
• article
  https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/
• report
  https://access.redhat.com/security/cve/CVE-2019-9516
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9516
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9516
• article
  https://github.com/nghttp2/nghttp2/issues/1382#
• report
  https://access.redhat.com/security/cve/CVE-2019-9517
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9517
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9517