| Name | CVE-2019-9511 |
| Description | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-4505-1, DSA-4511-1, DSA-4669-1 |
| Debian Bugs | 934885, 935037 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| nghttp2 (PTS) | jessie, jessie (lts) | 0.6.4-2+deb8u1 | fixed |
| stretch (security) | 1.18.1-1+deb9u2 | fixed | |
| stretch (lts), stretch | 1.18.1-1+deb9u4 | fixed | |
| buster (security), buster, buster (lts) | 1.36.0-2+deb10u3 | fixed | |
| bullseye | 1.43.0-1+deb11u1 | fixed | |
| bullseye (security) | 1.43.0-1+deb11u2 | fixed | |
| bookworm | 1.52.0-1+deb12u2 | fixed | |
| bookworm (security) | 1.52.0-1+deb12u1 | fixed | |
| sid, trixie | 1.64.0-1 | fixed | |
| nginx (PTS) | jessie, jessie (lts) | 1.6.2-5+deb8u10 | fixed |
| stretch (security) | 1.10.3-1+deb9u7 | fixed | |
| stretch (lts), stretch | 1.10.3-1+deb9u8 | fixed | |
| buster (security), buster, buster (lts) | 1.14.2-2+deb10u5 | fixed | |
| bullseye (security), bullseye | 1.18.0-6.1+deb11u3 | fixed | |
| bookworm | 1.22.1-9 | fixed | |
| sid, trixie | 1.26.0-3 | fixed | |
| nodejs (PTS) | jessie | 0.10.29~dfsg-2 | fixed |
| stretch | 4.8.2~dfsg-1 | fixed | |
| buster (security), buster, buster (lts) | 10.24.0~dfsg-1~deb10u4 | fixed | |
| bullseye | 12.22.12~dfsg-1~deb11u4 | fixed | |
| bullseye (security) | 12.22.12~dfsg-1~deb11u5 | fixed | |
| bookworm | 18.19.0+dfsg-6~deb12u2 | fixed | |
| bookworm (security) | 18.19.0+dfsg-6~deb12u1 | fixed | |
| trixie | 20.18.0+dfsg-2 | fixed | |
| sid | 20.18.1+dfsg-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| nghttp2 | source | wheezy | (unfixed) | end-of-life | ||
| nghttp2 | source | jessie | (not affected) | |||
| nghttp2 | source | stretch | 1.18.1-1+deb9u1 | DSA-4511-1 | ||
| nghttp2 | source | buster | 1.36.0-2+deb10u1 | DSA-4511-1 | ||
| nghttp2 | source | (unstable) | 1.39.2-1 | |||
| nginx | source | wheezy | (unfixed) | end-of-life | ||
| nginx | source | jessie | (not affected) | |||
| nginx | source | stretch | 1.10.3-1+deb9u3 | DSA-4505-1 | ||
| nginx | source | buster | 1.14.2-2+deb10u1 | DSA-4505-1 | ||
| nginx | source | (unstable) | 1.14.2-3 | 935037 | ||
| nodejs | source | jessie | (not affected) | |||
| nodejs | source | stretch | (not affected) | |||
| nodejs | source | buster | 10.19.0~dfsg1-1 | DSA-4669-1 | ||
| nodejs | source | (unstable) | 10.16.3~dfsg-1 | 934885 |
[jessie] - nginx <not-affected> (HTTP2 support only exists since version 1.9.5)
[stretch] - nodejs <not-affected> (No HTTP2 support yet)
[jessie] - nodejs <not-affected> (No HTTP2 support yet)
[jessie] - nghttp2 <not-affected> (Vulnerable code not present)
https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
https://github.com/nginx/nginx/commit/a987f81dd19210bc30b62591db331e31d3d74089 (master)
https://github.com/nginx/nginx/commit/94c5eb142e58a86f81eb1369fa6fcb96c2f23d6b (release-1.16.1)
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
https://github.com/nghttp2/nghttp2/releases/tag/v1.39.2