--- title: "CVE-2019-9513" canonical: "https://kb.cynergy.app/space/MD/899252763/CVE-2019-9513" format: markdown --- **Description:** Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU. **Published On:** 2019-08-13 **Updated On:** 8/13/2019 **Trending:** FALSE **Mitigation:** ![image](media://f6132b15-3c7c-466c-8e49-d29d06225062) Cynergy has an automated mitigation capability that requires integration with your WAF provider. Once integrated, you can request “Protect with WAF” This will move the exposed asset behind WAF protection **Note: **Policies configuration should be defined separately **Remediation:** Update based on the vendor recommendations: | | | | | | | | --- | --- | --- | --- | --- | --- | | Patch Id | Vendor | Fix Title | Fix Description | Fix Published On | Fix URL | | RHSA-2019:2925 | OpenSource | nodejs-packaging-17-3.module+el8+2873+aa7dfd9a | An update for the nodejs:10 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2022-04-24 | [https://access.redhat.com/errata/RHSA-2019:2925](https://access.redhat.com/errata/RHSA-2019:2925) | | RHSA-2019:2799 | OpenSource | nginx-1.14.1-9.module+el8.0.0+4108+af250afe | An update for the nginx:1.14 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2022-04-24 | [https://access.redhat.com/errata/RHSA-2019:2799](https://access.redhat.com/errata/RHSA-2019:2799) | | RHSA-2019:2692 | OpenSource | nghttp2-1.33.0-1.el8_0.1 | An update for nghttp2 is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2022-04-24 | [https://access.redhat.com/errata/RHSA-2019:2692](https://access.redhat.com/errata/RHSA-2019:2692) | | MGASA-2019-0291 | mageia | Updated nghttp2 packages fix security vulnerabilities | The updated packages fix security vulnerabilities:
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. (CVE-2019-9511)
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU. (CVE-2019-9513) | 2019-09-30 | [http://advisories.mageia.org/MGASA-2019-0291.html](http://advisories.mageia.org/MGASA-2019-0291.html) | | MGASA-2019-0342 | mageia | Updated nginx packages fix security vulnerabilities | Updated nginx packages fix security vulnerabilities:
When using HTTP/2 a client might cause excessive memory consumption and CPU usage (CVE-2019-9511, CVE-2019-9513, CVE-2019-9516). | 2020-04-13 | [http://advisories.mageia.org/MGASA-2019-0342.html](http://advisories.mageia.org/MGASA-2019-0342.html) | | openSUSE-SU-2019:2115-1 | suse | Security update for nodejs8 | This update for nodejs8 to version 8.16.1 fixes the following issues:
Security issues fixed:
- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091). - CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099). - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095). - CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100). - CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090). - CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097). - CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).
Bug fixes:
- Fixed that npm resolves its default config file like in all other versions, as /etc/nodejs/npmrc (bsc#1144919).
This update was imported from the SUSE:SLE-15:Update update project. | 2019-09-11 | [http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html](http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html) | | openSUSE-SU-2019:2114-1 | suse | Security update for nodejs10 | This update for nodejs10 to version 10.16.3 fixes the following issues:
Security issues fixed:
- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091). - CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099). - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095). - CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100). - CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090). - CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097). - CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).
This update was imported from the SUSE:SLE-15:Update update project. | 2019-09-11 | [http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html](http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html) | | openSUSE-SU-2019:2120-1 | suse | Security update for nginx | This update for nginx fixes the following issues:
Security issues fixed:
- CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579). - CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580). - CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582). - CVE-2018-16845: Fixed denial of service and memory disclosure via mp4 module (bsc#1115015). - CVE-2018-16843: Fixed excessive memory consumption in HTTP/2 implementation (bsc#1115022). - CVE-2018-16844: Fixed excessive CPU usage via flaw in HTTP/2 implementation (bsc#1115025).
This update was imported from the SUSE:SLE-15-SP1:Update update project. | 2019-09-11 | [http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html](http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html) | | openSUSE-SU-2019:2232-1 | suse | Security update for nghttp2 | This update for nghttp2 fixes the following issues:
Security issues fixed:
- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184). - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#11461).
Bug fixes and enhancements:
- Fixed mistake in spec file (bsc#1125689) - Fixed build issue with boost 1.70.0 (bsc#1134616) - Feature: Add W&S module (FATE#326776, bsc#1112438)
This update was imported from the SUSE:SLE-15:Update update project. | 2019-10-03 | [http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.html](http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.html) | | openSUSE-SU-2019:2234-1 | suse | Security update for nghttp2 | This update for nghttp2 fixes the following issues:
Security issues fixed:
- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184). - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#11461).
Bug fixes and enhancements:
- Fixed mistake in spec file (bsc#1125689) - Fixed build issue with boost 1.70.0 (bsc#1134616) - Feature: Add W&S module (FATE#326776, bsc#1112438)
This update was imported from the SUSE:SLE-15:Update update project. | 2019-10-03 | [http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.html](http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.html) | | openSUSE-SU-2019:2264-1 | suse | Security update for nginx | This update for nginx fixes the following issues:
Security issues fixed:
- CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579). - CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580). - CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582).
This update was imported from the SUSE:SLE-15:Update update project. | 2019-10-07 | [http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html](http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html) | | RHSA-2019:2692 | redhat | Red Hat Security Advisory: nghttp2 security update | An update for nghttp2 is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-09-11 | [https://access.redhat.com/errata/RHSA-2019:2692](https://access.redhat.com/errata/RHSA-2019:2692) | | RHSA-2019:2745 | redhat | Red Hat Security Advisory: rh-nginx110-nginx security update | An update for rh-nginx110-nginx is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-09-13 | [https://access.redhat.com/errata/RHSA-2019:2745](https://access.redhat.com/errata/RHSA-2019:2745) | | RHSA-2019:2746 | redhat | Red Hat Security Advisory: rh-nginx112-nginx security update | An update for rh-nginx112-nginx is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-09-13 | [https://access.redhat.com/errata/RHSA-2019:2746](https://access.redhat.com/errata/RHSA-2019:2746) | | RHSA-2019:2775 | redhat | Red Hat Security Advisory: rh-nginx114-nginx security update | An update for rh-nginx114-nginx is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-09-18 | [https://access.redhat.com/errata/RHSA-2019:2775](https://access.redhat.com/errata/RHSA-2019:2775) | | RHSA-2019:2799 | redhat | Red Hat Security Advisory: nginx:1.14 security update | An update for the nginx:1.14 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-09-20 | [https://access.redhat.com/errata/RHSA-2019:2799](https://access.redhat.com/errata/RHSA-2019:2799) | | RHSA-2019:2925 | redhat | Red Hat Security Advisory: nodejs:10 security update | An update for the nodejs:10 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-09-30 | [https://access.redhat.com/errata/RHSA-2019:2925](https://access.redhat.com/errata/RHSA-2019:2925) | | RHSA-2019:2939 | redhat | Red Hat Security Advisory: rh-nodejs10-nodejs security update | An update for rh-nodejs10-nodejs is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-10-01 | [https://access.redhat.com/errata/RHSA-2019:2939](https://access.redhat.com/errata/RHSA-2019:2939) | | RHSA-2019:2949 | redhat | Red Hat Security Advisory: httpd24-httpd and httpd24-nghttp2 security update | An update for httpd24-httpd and httpd24-nghttp2 is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-10-03 | [https://access.redhat.com/errata/RHSA-2019:2949](https://access.redhat.com/errata/RHSA-2019:2949) | | RHSA-2019:2955 | redhat | Red Hat Security Advisory: rh-nodejs8-nodejs security update | An update for rh-nodejs8-nodejs is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-10-03 | [https://access.redhat.com/errata/RHSA-2019:2955](https://access.redhat.com/errata/RHSA-2019:2955) | | RHSA-2019:2966 | redhat | Red Hat Security Advisory: Red Hat Quay v3.1.1 security update | Updated Quay packages that fix several bugs and add various enhancements are now available.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-10-05 | [https://access.redhat.com/errata/RHSA-2019:2966](https://access.redhat.com/errata/RHSA-2019:2966) | | RHSA-2019:3041 | redhat | Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.1 RPMs | Red Hat OpenShift Service Mesh 1.0.1.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-10-15 | [https://access.redhat.com/errata/RHSA-2019:3041](https://access.redhat.com/errata/RHSA-2019:3041) | | RHSA-2019:3932 | redhat | Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6 | Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-11-21 | [https://access.redhat.com/errata/RHSA-2019:3932](https://access.redhat.com/errata/RHSA-2019:3932) | | RHSA-2019:3933 | redhat | Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7 | An update is now available for JBoss Core Services on RHEL 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-11-21 | [https://access.redhat.com/errata/RHSA-2019:3933](https://access.redhat.com/errata/RHSA-2019:3933) | | RHSA-2019:3935 | redhat | Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release | Red Hat JBoss Core Services Pack Apache Server 2.4.37 zip release for RHEL 6, RHEL 7 and Microsoft Windows is available.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-11-21 | [https://access.redhat.com/errata/RHSA-2019:3935](https://access.redhat.com/errata/RHSA-2019:3935) | | RHSA-2020:0983 | redhat | Red Hat Security Advisory: Red Hat Fuse 7.6.0 security update | A minor version update (from 7.5 to 7.6) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
[2020-04-17 update: descriptions for mutiple components fixed for the same CVE added; also added golang CVE descriptions that were unintentionally ommitted from the original publication] | 2020-03-27 | [https://access.redhat.com/errata/RHSA-2020:0983](https://access.redhat.com/errata/RHSA-2020:0983) | | FEDORA-2019-5a6a7bc12c | fedora | Fedora 30 Update: nodejs-10.16.3-1.fc30 | Update to Node.js 10.6.13 | 2019-08-25 | [https://bodhi.fedoraproject.org/updates/FEDORA-2019-5a6a7bc12c](https://bodhi.fedoraproject.org/updates/FEDORA-2019-5a6a7bc12c) | | FEDORA-2019-6a2980de56 | fedora | Fedora 29 Update: nodejs-10.16.3-1.fc29 | Update to Node.js 10.6.13 | 2019-08-25 | [https://bodhi.fedoraproject.org/updates/FEDORA-2019-6a2980de56](https://bodhi.fedoraproject.org/updates/FEDORA-2019-6a2980de56) | | FEDORA-2019-7a0b45fdc4 | fedora | Fedora 29 Update: nginx-1.16.1-1.fc29 | Security fix for CVE-2019-9511, CVE-2019-9513, CVE-2019-9516 | 2020-10-10 | [https://bodhi.fedoraproject.org/updates/FEDORA-2019-7a0b45fdc4](https://bodhi.fedoraproject.org/updates/FEDORA-2019-7a0b45fdc4) | | FEDORA-2019-81985a8858 | fedora | Fedora 30 Update: nghttp2-1.39.2-1.fc30 | - update to the latest upstream release (fixes CVE-2019-9511 and CVE-2019-9513) | 2019-08-23 | [https://bodhi.fedoraproject.org/updates/FEDORA-2019-81985a8858](https://bodhi.fedoraproject.org/updates/FEDORA-2019-81985a8858) | | FEDORA-2019-8a437d5c2f | fedora | Fedora 29 Update: nghttp2-1.39.2-1.fc29 | - update to the latest upstream release (fixes CVE-2019-9511 and CVE-2019-9513) | 2019-08-28 | [https://bodhi.fedoraproject.org/updates/FEDORA-2019-8a437d5c2f](https://bodhi.fedoraproject.org/updates/FEDORA-2019-8a437d5c2f) | | FEDORA-2019-befd924cfe | fedora | Fedora 30 Update: nginx-1.16.1-1.fc30 | Fixes CVE-2019-9511, CVE-2019-9513, CVE-2019-9516 | 2019-08-22 | [https://bodhi.fedoraproject.org/updates/FEDORA-2019-befd924cfe](https://bodhi.fedoraproject.org/updates/FEDORA-2019-befd924cfe) | | openSUSE-SU-2019:2115-1 | suse | Security update for nodejs8 | This update for nodejs8 to version 8.16.1 fixes the following issues:
Security issues fixed:
- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091). - CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099). - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095). - CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100). - CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090). - CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097). - CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).
Bug fixes:
- Fixed that npm resolves its default config file like in all other versions, as /etc/nodejs/npmrc (bsc#1144919).
This update was imported from the SUSE:SLE-15:Update update project. | 2021-04-16 | [https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html](https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html) | | openSUSE-SU-2019:2114-1 | suse | Security update for nodejs10 | This update for nodejs10 to version 10.16.3 fixes the following issues:
Security issues fixed:
- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091). - CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099). - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095). - CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100). - CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090). - CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097). - CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).
This update was imported from the SUSE:SLE-15:Update update project. | 2021-04-16 | [https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html](https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html) | | openSUSE-SU-2019:2120-1 | suse | Security update for nginx | This update for nginx fixes the following issues:
Security issues fixed:
- CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579). - CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580). - CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582). - CVE-2018-16845: Fixed denial of service and memory disclosure via mp4 module (bsc#1115015). - CVE-2018-16843: Fixed excessive memory consumption in HTTP/2 implementation (bsc#1115022). - CVE-2018-16844: Fixed excessive CPU usage via flaw in HTTP/2 implementation (bsc#1115025).
This update was imported from the SUSE:SLE-15-SP1:Update update project. | 2021-04-16 | [https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html](https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html) | | openSUSE-SU-2019:2232-1 | suse | Security update for nghttp2 | This update for nghttp2 fixes the following issues:
Security issues fixed:
- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184). - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#11461).
Bug fixes and enhancements:
- Fixed mistake in spec file (bsc#1125689) - Fixed build issue with boost 1.70.0 (bsc#1134616) - Feature: Add W&S module (FATE#326776, bsc#1112438)
This update was imported from the SUSE:SLE-15:Update update project. | 2021-04-16 | [https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.html](https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.html) | | openSUSE-SU-2019:2234-1 | suse | Security update for nghttp2 | This update for nghttp2 fixes the following issues:
Security issues fixed:
- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184). - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#11461).
Bug fixes and enhancements:
- Fixed mistake in spec file (bsc#1125689) - Fixed build issue with boost 1.70.0 (bsc#1134616) - Feature: Add W&S module (FATE#326776, bsc#1112438)
This update was imported from the SUSE:SLE-15:Update update project. | 2021-04-16 | [https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.html](https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.html) | | openSUSE-SU-2019:2264-1 | suse | Security update for nginx | This update for nginx fixes the following issues:
Security issues fixed:
- CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579). - CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580). - CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582).
This update was imported from the SUSE:SLE-15:Update update project. | 2021-04-16 | [https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html](https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html) | | usn-4099-1 | canonical | nginx vulnerabilities | Jonathan Looney discovered that nginx incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to consume resources, leading to a denial of service. | 2020-07-29 | [https://ubuntu.com/security/notices/USN-4099-1](https://ubuntu.com/security/notices/USN-4099-1) | | DSA-4511 | debian | DSA-4511-1 nghttp2 -- security update | Two vulnerabilities were discovered in the HTTP/2 code of the nghttp2 HTTP server, which could result in denial of service. For the oldstable distribution (stretch), these problems have been fixed in version 1.18.1-1+deb9u1. For the stable distribution (buster), these problems have been fixed in version 1.36.0-2+deb10u1. We recommend that you upgrade your nghttp2 packages. For the detailed security status of nghttp2 please refer to its security tracker page at: [https://security-tracker.debian.org/tracker/nghttp2](https://security-tracker.debian.org/tracker/nghttp2) | 2020-10-10 | [https://www.debian.org/security/2019/dsa-4511](https://www.debian.org/security/2019/dsa-4511) | | SUSE-SU-2019:14246-1 | suse | Security update for Mozilla Firefox | This update contains the Mozilla Firefox ESR 68.2 release.
Mozilla Firefox was updated to ESR 68.2 release:
- Enterprise: New administrative policies were added. More
information and templates are available at the Policy   Templates page.
- Various security fixes:
MFSA 2019-33 (bsc#1154738)
- CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber - CVE-2019-11757: Use-after-free when creating index updates in IndexedDB - CVE-2019-11758: Potentially exploitable crash due to 360 Total Security - CVE-2019-11759: Stack buffer overflow in HKDF output - CVE-2019-11760: Stack buffer overflow in WebRTC networking - CVE-2019-11761: Unintended access to a privileged JSONView object - CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation - CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique - CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2
Other Issues resolved:
- [bsc#1104841] Newer versions of firefox have a dependency on
GLIBCXX_3.4.20
- [bsc#1074235] MozillaFirefox: background tab crash reports sent
inadvertently without user opt-in
- [bsc#1043008] Firefox hangs randomly when browsing and
scrolling
- [bsc#1025108] Firefox stops loading page until mouse is moved - [bsc#905528]  Firefox malfunctions due to broken omni.ja
archives | 2019-12-12 | [https://www.suse.com/support/update/announcement/2019/suse-su-201914246-1/](https://www.suse.com/support/update/announcement/2019/suse-su-201914246-1/) | | SUSE-SU-2019:2254-1 | suse | Security update for nodejs10 | This update for nodejs10 to version 10.16.3 fixes the following issues:
Security issues fixed:
- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091). - CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099). - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095). - CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100). - CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090). - CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097). - CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093). | 2019-08-31 | [https://www.suse.com/support/update/announcement/2019/suse-su-20192254-1/](https://www.suse.com/support/update/announcement/2019/suse-su-20192254-1/) | | SUSE-SU-2019:2259-1 | suse | Security update for nodejs10 | This update for nodejs10 to version 10.16.3 fixes the following issues:
Security issues fixed:
- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091). - CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099). - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095). - CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100). - CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090). - CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097). - CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093). | 2020-09-25 | [https://www.suse.com/support/update/announcement/2019/suse-su-20192259-1/](https://www.suse.com/support/update/announcement/2019/suse-su-20192259-1/) | | SUSE-SU-2019:2260-1 | suse | Security update for nodejs8 | This update for nodejs8 to version 8.16.1 fixes the following issues:
Security issues fixed:
- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091). - CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099). - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095). - CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100). - CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090). - CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097). - CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).
Bug fixes:
- Fixed that npm resolves its default config file like in all other versions, as /etc/nodejs/npmrc (bsc#1144919). | 2020-09-25 | [https://www.suse.com/support/update/announcement/2019/suse-su-20192260-1/](https://www.suse.com/support/update/announcement/2019/suse-su-20192260-1/) | | SUSE-SU-2019:2309-1 | suse | Security update for nginx | This update for nginx fixes the following issues:
Security issues fixed:
- CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579). - CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580). - CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582). - CVE-2018-16845: Fixed denial of service and memory disclosure via mp4 module (bsc#1115015). - CVE-2018-16843: Fixed excessive memory consumption in HTTP/2 implementation (bsc#1115022). - CVE-2018-16844: Fixed excessive CPU usage via flaw in HTTP/2 implementation (bsc#1115025). | 2019-09-06 | [https://www.suse.com/support/update/announcement/2019/suse-su-20192309-1/](https://www.suse.com/support/update/announcement/2019/suse-su-20192309-1/) | | SUSE-SU-2019:2473-1 | suse | Security update for nghttp2 | This update for nghttp2 fixes the following issues:
Security issues fixed:
- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184). - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#11461).
Bug fixes and enhancements:
- Fixed mistake in spec file (bsc#1125689) - Fixed build issue with boost 1.70.0 (bsc#1134616) - Feature: Add W&S module (FATE#326776, bsc#1112438) | 2019-09-27 | [https://www.suse.com/support/update/announcement/2019/suse-su-20192473-1/](https://www.suse.com/support/update/announcement/2019/suse-su-20192473-1/) | | SUSE-SU-2019:2559-1 | suse | Security update for nginx | This update for nginx fixes the following issues:
Security issues fixed:
- CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579). - CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580). - CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582). | 2019-10-05 | [https://www.suse.com/support/update/announcement/2019/suse-su-20192559-1/](https://www.suse.com/support/update/announcement/2019/suse-su-20192559-1/) | | SUSE-SU-2020:0059-1 | suse | Security update for nodejs12 | This update for nodejs12 fixes the following issues:
Update to LTS release 12.13.0 (jsc#SLE-8947).
Security issues fixed:
- CVE-2019-9511: Fixed the HTTP/2 implementation that was vulnerable to window size manipulations (bsc#1146091). - CVE-2019-9512: Fixed the HTTP/2 implementation that was vulnerable to floods using PING frames (bsc#1146099). - CVE-2019-9513: Fixed the HTTP/2 implementation that was vulnerable to resource loops, potentially leading to a denial of service (bsc#1146094). - CVE-2019-9514: Fixed the HTTP/2 implementation that was vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095). - CVE-2019-9515: Fixed the HTTP/2 implementation that was vulnerable to a SETTINGS frame flood (bsc#1146100). - CVE-2019-9516: Fixed the HTTP/2 implementation that was vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090). - CVE-2019-9517: Fixed the HTTP/2 implementation that was vulnerable to unconstrained interal data buffering (bsc#1146097). - CVE-2019-9518: Fixed the HTTP/2 implementation that was vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093). - CVE-2019-13173: Fixed a file overwrite in the fstream.DirWriter() function (bsc#1140290). | 2020-01-17 | [https://www.suse.com/support/update/announcement/2020/suse-su-20200059-1/](https://www.suse.com/support/update/announcement/2020/suse-su-20200059-1/) | | SUSE-SU-2021:0932-1 | suse | Security update for nghttp2 | This update for nghttp2 fixes the following issues:
Security issues fixed:
- CVE-2020-11080: HTTP/2 Large Settings Frame DoS (bsc#1181358). - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184). - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146182). - CVE-2018-1000168: Fixed ALTSVC frame client side denial of service (bsc#1088639). - CVE-2016-1544: Fixed out of memory due to unlimited incoming HTTP header fields (bsc#966514).
Bug fixes and enhancements:
- Packages must not mark license files as %doc (bsc#1082318) - Typo in description of libnghttp2_asio1 (bsc#962914) - Fixed mistake in spec file (bsc#1125689) - Fixed build issue with boost 1.70.0 (bsc#1134616) - Fixed build issue with GCC 6 (bsc#964140) - Feature: Add W&S module (FATE#326776, bsc#1112438) | 2021-03-27 | [https://www.suse.com/support/update/announcement/2021/suse-su-20210932-1/](https://www.suse.com/support/update/announcement/2021/suse-su-20210932-1/) |