CVE-2019-9515

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.16.3).

Security Fix(es):

• HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

• HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

• HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

• HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

• HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

• HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

• HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

• HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.16.3).

Security Fix(es):

• HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

• HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

• HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

• HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

• HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

• HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

• HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

• HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The nodejs package has been updated to the latest version in the 10.x branch, which is 10.22.1 at this time. It fixes several security issues and other bugs. See the upstream changelog and advisories for details.

This update for nodejs10 to version 10.16.3 fixes the following issues:

Security issues fixed:

• CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
• CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
• CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
• CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
• CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
• CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
• CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
• CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).

This update was imported from the SUSE:SLE-15:Update update project.

This update for nodejs8 to version 8.16.1 fixes the following issues:

Security issues fixed:

• CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
• CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
• CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
• CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
• CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
• CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
• CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
• CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).

Bug fixes:

• Fixed that npm resolves its default config file like in all other versions, as /etc/nodejs/npmrc (bsc#1144919).

This update was imported from the SUSE:SLE-15:Update update project.

This update contains the Mozilla Firefox ESR 68.2 release.

Mozilla Firefox was updated to ESR 68.2 release:

• Enterprise: New administrative policies were added. More information and templates are available at the Policy Templates page.

• Various security fixes: MFSA 2019-33 (bsc#1154738)

  • CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber
  • CVE-2019-11757: Use-after-free when creating index updates in IndexedDB
  • CVE-2019-11758: Potentially exploitable crash due to 360 Total Security
  • CVE-2019-11759: Stack buffer overflow in HKDF output
  • CVE-2019-11760: Stack buffer overflow in WebRTC networking
  • CVE-2019-11761: Unintended access to a privileged JSONView object
  • CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation
  • CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique
  • CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2

Other Issues resolved:

• [bsc#1104841] Newer versions of firefox have a dependency on GLIBCXX_3.4.20
• [bsc#1074235] MozillaFirefox: background tab crash reports sent inadvertently without user opt-in
• [bsc#1043008] Firefox hangs randomly when browsing and scrolling
• [bsc#1025108] Firefox stops loading page until mouse is moved
• [bsc#905528] Firefox malfunctions due to broken omni.ja archives

This update for nodejs10 to version 10.16.3 fixes the following issues:

Security issues fixed:

• CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
• CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
• CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
• CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
• CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
• CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
• CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
• CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).

This update for nodejs10 to version 10.16.3 fixes the following issues:

Security issues fixed:

• CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
• CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
• CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
• CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
• CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
• CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
• CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
• CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).

This update for nodejs8 to version 8.16.1 fixes the following issues:

Security issues fixed:

• CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
• CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
• CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
• CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
• CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
• CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
• CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
• CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).

Bug fixes:

• Fixed that npm resolves its default config file like in all other versions, as /etc/nodejs/npmrc (bsc#1144919).

This update for nodejs12 fixes the following issues:

Update to LTS release 12.13.0 (jsc#SLE-8947).

Security issues fixed:

• CVE-2019-9511: Fixed the HTTP/2 implementation that was vulnerable to window size manipulations (bsc#1146091).
• CVE-2019-9512: Fixed the HTTP/2 implementation that was vulnerable to floods using PING frames (bsc#1146099).
• CVE-2019-9513: Fixed the HTTP/2 implementation that was vulnerable to resource loops, potentially leading to a denial of service (bsc#1146094).
• CVE-2019-9514: Fixed the HTTP/2 implementation that was vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
• CVE-2019-9515: Fixed the HTTP/2 implementation that was vulnerable to a SETTINGS frame flood (bsc#1146100).
• CVE-2019-9516: Fixed the HTTP/2 implementation that was vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
• CVE-2019-9517: Fixed the HTTP/2 implementation that was vulnerable to unconstrained interal data buffering (bsc#1146097).
• CVE-2019-9518: Fixed the HTTP/2 implementation that was vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).
• CVE-2019-13173: Fixed a file overwrite in the fstream.DirWriter() function (bsc#1140290).

it was discovered that Twisted incorrectly validated or sanitized certain URIs or HTTP methods. A remote attacker could use this issue to inject invalid characters and possibly perform header injection attacks. (CVE-2019-12387)

It was discovered that Twisted incorrectly verified XMPP TLS certificates. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack and obtain sensitive information. (CVE-2019-12855)

It was discovered that Twisted incorrectly handled HTTP/2 connections. A remote attacker could possibly use this issue to cause Twisted to hang or consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-9512, CVE-2019-9514, CVE-2019-9515)

Jake Miller and ZeddYu Lu discovered that Twisted incorrectly handled certain content-length headers. A remote attacker could possibly use this issue to perform HTTP request splitting attacks. (CVE-2020-10108, CVE-2020-10109)

It was discovered that Netty incorrectly implements HTTP/2. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-9512, CVE-2019-9514, CVE-2019-9515, CVE-2019-9518)