CVE-2019-9516

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 (Post Office Protocol 3) and IMAP protocols, with a focus on high concurrency, performance and low memory usage.

Security Fix(es):

• HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511)

• HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513)

• HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.16.3).

Security Fix(es):

• HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

• HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

• HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

• HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

• HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

• HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

• HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

• HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 (Post Office Protocol 3) and IMAP protocols, with a focus on high concurrency, performance and low memory usage.

Security Fix(es):

• HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511)

• HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513)

• HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.16.3).

Security Fix(es):

• HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

• HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

• HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

• HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

• HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

• HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

• HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

• HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Updated nginx packages fix security vulnerabilities:

When using HTTP/2 a client might cause excessive memory consumption and CPU usage (CVE-2019-9511, CVE-2019-9513, CVE-2019-9516).

The nodejs package has been updated to the latest version in the 10.x branch, which is 10.22.1 at this time. It fixes several security issues and other bugs. See the upstream changelog and advisories for details.

This update for nodejs10 to version 10.16.3 fixes the following issues:

Security issues fixed:

• CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
• CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
• CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
• CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
• CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
• CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
• CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
• CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).

This update was imported from the SUSE:SLE-15:Update update project.

This update for nodejs8 to version 8.16.1 fixes the following issues:

Security issues fixed:

• CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
• CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
• CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
• CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
• CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
• CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
• CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
• CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).

Bug fixes:

• Fixed that npm resolves its default config file like in all other versions, as /etc/nodejs/npmrc (bsc#1144919).

This update was imported from the SUSE:SLE-15:Update update project.

This update for nginx fixes the following issues:

Security issues fixed:

• CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579).
• CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580).
• CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582).
• CVE-2018-16845: Fixed denial of service and memory disclosure via mp4 module (bsc#1115015).
• CVE-2018-16843: Fixed excessive memory consumption in HTTP/2 implementation (bsc#1115022).
• CVE-2018-16844: Fixed excessive CPU usage via flaw in HTTP/2 implementation (bsc#1115025).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for nginx fixes the following issues:

Security issues fixed:

• CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579).
• CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580).
• CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the nginx-1.21.3-1.4 package on the GA media of openSUSE Tumbleweed.

This update contains the Mozilla Firefox ESR 68.2 release.

Mozilla Firefox was updated to ESR 68.2 release:

• Enterprise: New administrative policies were added. More information and templates are available at the Policy Templates page.

• Various security fixes: MFSA 2019-33 (bsc#1154738)

  • CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber
  • CVE-2019-11757: Use-after-free when creating index updates in IndexedDB
  • CVE-2019-11758: Potentially exploitable crash due to 360 Total Security
  • CVE-2019-11759: Stack buffer overflow in HKDF output
  • CVE-2019-11760: Stack buffer overflow in WebRTC networking
  • CVE-2019-11761: Unintended access to a privileged JSONView object
  • CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation
  • CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique
  • CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2

Other Issues resolved:

• [bsc#1104841] Newer versions of firefox have a dependency on GLIBCXX_3.4.20
• [bsc#1074235] MozillaFirefox: background tab crash reports sent inadvertently without user opt-in
• [bsc#1043008] Firefox hangs randomly when browsing and scrolling
• [bsc#1025108] Firefox stops loading page until mouse is moved
• [bsc#905528] Firefox malfunctions due to broken omni.ja archives

This update for nodejs10 to version 10.16.3 fixes the following issues:

Security issues fixed:

• CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
• CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
• CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
• CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
• CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
• CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
• CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
• CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).

This update for nodejs10 to version 10.16.3 fixes the following issues:

Security issues fixed:

• CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
• CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
• CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
• CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
• CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
• CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
• CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
• CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).

This update for nodejs8 to version 8.16.1 fixes the following issues:

Security issues fixed:

• CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
• CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
• CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
• CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
• CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
• CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
• CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
• CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).

Bug fixes:

• Fixed that npm resolves its default config file like in all other versions, as /etc/nodejs/npmrc (bsc#1144919).

This update for nginx fixes the following issues:

Security issues fixed:

• CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579).
• CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580).
• CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582).
• CVE-2018-16845: Fixed denial of service and memory disclosure via mp4 module (bsc#1115015).
• CVE-2018-16843: Fixed excessive memory consumption in HTTP/2 implementation (bsc#1115022).
• CVE-2018-16844: Fixed excessive CPU usage via flaw in HTTP/2 implementation (bsc#1115025).

This update for nginx fixes the following issues:

Security issues fixed:

• CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579).
• CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580).
• CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582).

This update for nodejs12 fixes the following issues:

Update to LTS release 12.13.0 (jsc#SLE-8947).

Security issues fixed:

• CVE-2019-9511: Fixed the HTTP/2 implementation that was vulnerable to window size manipulations (bsc#1146091).
• CVE-2019-9512: Fixed the HTTP/2 implementation that was vulnerable to floods using PING frames (bsc#1146099).
• CVE-2019-9513: Fixed the HTTP/2 implementation that was vulnerable to resource loops, potentially leading to a denial of service (bsc#1146094).
• CVE-2019-9514: Fixed the HTTP/2 implementation that was vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
• CVE-2019-9515: Fixed the HTTP/2 implementation that was vulnerable to a SETTINGS frame flood (bsc#1146100).
• CVE-2019-9516: Fixed the HTTP/2 implementation that was vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
• CVE-2019-9517: Fixed the HTTP/2 implementation that was vulnerable to unconstrained interal data buffering (bsc#1146097).
• CVE-2019-9518: Fixed the HTTP/2 implementation that was vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).
• CVE-2019-13173: Fixed a file overwrite in the fstream.DirWriter() function (bsc#1140290).

Jonathan Looney discovered that nginx incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to consume resources, leading to a denial of service.