CVE-2019-9514: Golang.org/x/net Golang.org/x/net/http Vulnerable To A Reset Vulnerability

Q: What is CVE-2019-9514?

CVE-2019-9514 is a security vulnerability in Golang.org/x/net involving golang.org/x/net/http vulnerable to a reset flood under CWE-400: Uncontrolled Resource Consumption.

Q: Which Golang.org/x/net versions are affected?

Affected versions include releases prior to 0.0.0-20190813141303-74dc4d7220e7 across affected packages: golang.org/x/net.

Q: What version fixes CVE-2019-9514?

Upgrading to 0.0.0-20190813141303-74dc4d7220e7 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is golang.org/x/net affected?

Yes, golang.org/x/net is affected in releases prior to 0.0.0-20190813141303-74dc4d7220e7. Upgrade your dependency to 0.0.0-20190813141303-74dc4d7220e7 or later.

Q: What is the CVSS score of CVE-2019-9514?

CVE-2019-9514 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Q: What CWE is associated with CVE-2019-9514?

CVE-2019-9514 is classified under CWE-400: Uncontrolled Resource Consumption (The product does not properly control the allocation and maintenance of a limited resource.).

Q: How can I check Go dependencies for CVE-2019-9514?

Run the dependency tree command: 'inspect dependencies for golang.org/x/net'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-39qc-96h7-956f

CVSS 7.5

CWE-400 CWE-770

Published 2022-05-24

Advisory Summary

CVE-2019-9514 is a HIGH (CVSS 7.5) golang.org/x/net/http vulnerable to a reset vulnerability (CWE-400: Uncontrolled Resource Consumption) affecting Golang.org/x/net libraries in the Go ecosystem. The issue involves golang.org/x/net/http vulnerable to a reset flood. Remediation is available by upgrading affected packages to version 0.0.0-20190813141303-74dc4d7220e7.

CVE-2019-9514 at a Glance

CVE Identifier CVE-2019-9514

GHSA Identifier GHSA-39qc-96h7-956f

Severity HIGH

CVSS v3.1 Base Score 7.5

CWE Classification CWE-400: Uncontrolled Resource Consumption

Affected Product Golang.org/x/net

Package Ecosystem Go

Published Date 2022-05-24

Last Updated 2024-05-20

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity None (I:N)

Availability High (A:H)

How to Fix CVE-2019-9514

To remediate this vulnerability, upgrade all affected Golang.org/x/net dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

golang.org/x/net fixed: 0.0.0-20190813141303-74dc4d7220e7

Upgrade golang.org/x/net to 0.0.0-20190813141303-74dc4d7220e7

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for golang.org/x/net

How to Check if You Are Affected

To determine whether your application is affected by CVE-2019-9514, inspect your project dependencies for Golang.org/x/net:

inspect dependencies for golang.org/x/net

Analyze the terminal output to locate any version of Golang.org/x/net in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.0.0-20190813141303-74dc4d7220e7), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, where the product does not properly control the allocation and maintenance of a limited resource. In Golang.org/x/net, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both. ### Specific Go Packages Affected golang.org/x/net/http2

CVE-2019-9514 Affected Golang.org/x/net Versions

1 component(s)

Fixed Versions:

0.0.0-20190813141303-74dc4d7220e7

Product / Package	Ecosystem	Affected Versions	Fixed Version
golang.org/x/net golang/golang.org/x/net	Go	< 0.0.0-20190813141303-74dc4d7220e7	0.0.0-20190813141303-74dc4d7220e7

References

NVD — CVE-2019-9514 NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-9514

access.redhat.com/errata/rhsa-2019:25... WEB

https://access.redhat.com/errata/RHSA-2019:2594

go.dev/cl/190137 WEB

https://go.dev/cl/190137

go.dev/issue/33606 WEB

https://go.dev/issue/33606

go.googlesource.com/go/+/145e193131eb48... WEB

https://go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5

groups.google.com/g/golang-announce/c... WEB

https://groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ

kb.cert.org/vuls/id/605641 WEB

https://kb.cert.org/vuls/id/605641

kc.mcafee.com/corporate/index WEB

https://kc.mcafee.com/corporate/index?page=content&id=SB10296

lists.apache.org/thread.html/3921083... WEB

https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04@%3Cusers.trafficserver.apache.org%3E

lists.apache.org/thread.html/ad3d01e... WEB

https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19@%3Cannounce.trafficserver.apache.org%3E

lists.apache.org/thread.html/bde5230... WEB

https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7@%3Cdev.trafficserver.apache.org%3E

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html

seclists.org/bugtraq/2019/aug/43 WEB

https://seclists.org/bugtraq/2019/Aug/43

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ

pkg.go.dev/vuln/go-2022-0536 WEB

https://pkg.go.dev/vuln/GO-2022-0536

seclists.org/bugtraq/2019/aug/24 WEB

https://seclists.org/bugtraq/2019/Aug/24

seclists.org/bugtraq/2019/aug/31 WEB

https://seclists.org/bugtraq/2019/Aug/31

seclists.org/bugtraq/2019/sep/18 WEB

https://seclists.org/bugtraq/2019/Sep/18

Golang.org/x/net Security Information SECURITY

https://security.netapp.com/advisory/ntap-20190823-0001

Golang.org/x/net Security Information SECURITY

https://security.netapp.com/advisory/ntap-20190823-0004

Golang.org/x/net Security Information SECURITY

https://security.netapp.com/advisory/ntap-20190823-0005

support.f5.com/csp/article/k019883... WEB

https://support.f5.com/csp/article/K01988340

support.f5.com/csp/article/k019883... WEB

https://support.f5.com/csp/article/K01988340?utm_source=f5support&utm_medium=RSS

usn.ubuntu.com/4308-1 WEB

https://usn.ubuntu.com/4308-1

Golang.org/x/net Security Information SECURITY

https://www.debian.org/security/2019/dsa-4503

Golang.org/x/net Security Information SECURITY

https://www.debian.org/security/2019/dsa-4508

Golang.org/x/net Security Information SECURITY

https://www.debian.org/security/2019/dsa-4520

Golang.org/x/net Security Information SECURITY

https://www.debian.org/security/2020/dsa-4669

Golang.org/x/net Security Information SECURITY

https://www.synology.com/security/advisory/Synology_SA_19_33

access.redhat.com/errata/rhsa-2019:26... WEB

https://access.redhat.com/errata/RHSA-2019:2661

access.redhat.com/errata/rhsa-2019:26... WEB

https://access.redhat.com/errata/RHSA-2019:2682

access.redhat.com/errata/rhsa-2019:26... WEB

https://access.redhat.com/errata/RHSA-2019:2690

access.redhat.com/errata/rhsa-2019:27... WEB

https://access.redhat.com/errata/RHSA-2019:2726

access.redhat.com/errata/rhsa-2019:27... WEB

https://access.redhat.com/errata/RHSA-2019:2766

access.redhat.com/errata/rhsa-2019:27... WEB

https://access.redhat.com/errata/RHSA-2019:2769

access.redhat.com/errata/rhsa-2019:27... WEB

https://access.redhat.com/errata/RHSA-2019:2796

access.redhat.com/errata/rhsa-2019:28... WEB

https://access.redhat.com/errata/RHSA-2019:2861

access.redhat.com/errata/rhsa-2019:29... WEB

https://access.redhat.com/errata/RHSA-2019:2925

access.redhat.com/errata/rhsa-2019:29... WEB

https://access.redhat.com/errata/RHSA-2019:2939

access.redhat.com/errata/rhsa-2019:29... WEB

https://access.redhat.com/errata/RHSA-2019:2955

access.redhat.com/errata/rhsa-2019:29... WEB

https://access.redhat.com/errata/RHSA-2019:2966

access.redhat.com/errata/rhsa-2019:31... WEB

https://access.redhat.com/errata/RHSA-2019:3131

access.redhat.com/errata/rhsa-2019:32... WEB

https://access.redhat.com/errata/RHSA-2019:3245

access.redhat.com/errata/rhsa-2019:32... WEB

https://access.redhat.com/errata/RHSA-2019:3265

access.redhat.com/errata/rhsa-2019:38... WEB

https://access.redhat.com/errata/RHSA-2019:3892

access.redhat.com/errata/rhsa-2019:39... WEB

https://access.redhat.com/errata/RHSA-2019:3906

access.redhat.com/errata/rhsa-2019:40... WEB

https://access.redhat.com/errata/RHSA-2019:4018

access.redhat.com/errata/rhsa-2019:40... WEB

https://access.redhat.com/errata/RHSA-2019:4019

access.redhat.com/errata/rhsa-2019:40... WEB

https://access.redhat.com/errata/RHSA-2019:4020

access.redhat.com/errata/rhsa-2019:40... WEB

https://access.redhat.com/errata/RHSA-2019:4021

access.redhat.com/errata/rhsa-2019:40... WEB

https://access.redhat.com/errata/RHSA-2019:4040

access.redhat.com/errata/rhsa-2019:40... WEB

https://access.redhat.com/errata/RHSA-2019:4041

access.redhat.com/errata/rhsa-2019:40... WEB

https://access.redhat.com/errata/RHSA-2019:4042

access.redhat.com/errata/rhsa-2019:40... WEB

https://access.redhat.com/errata/RHSA-2019:4045

access.redhat.com/errata/rhsa-2019:42... WEB

https://access.redhat.com/errata/RHSA-2019:4269

access.redhat.com/errata/rhsa-2019:42... WEB

https://access.redhat.com/errata/RHSA-2019:4273

access.redhat.com/errata/rhsa-2019:43... WEB

https://access.redhat.com/errata/RHSA-2019:4352

access.redhat.com/errata/rhsa-2020:04... WEB

https://access.redhat.com/errata/RHSA-2020:0406

access.redhat.com/errata/rhsa-2020:07... WEB

https://access.redhat.com/errata/RHSA-2020:0727

GitHub Advisory / Wiki ADVISORY

https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

Golang.org/x/net Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html

Golang.org/x/net Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html

Golang.org/x/net Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html

Golang.org/x/net Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html

Golang.org/x/net Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html

Golang.org/x/net Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html

Golang.org/x/net Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html

seclists.org/fulldisclosure/2019... WEB

http://seclists.org/fulldisclosure/2019/Aug/16

Golang.org/x/net Security Information SECURITY

http://www.openwall.com/lists/oss-security/2019/08/20/1

Golang.org/x/net Security Information SECURITY

http://www.openwall.com/lists/oss-security/2023/10/18/8

Frequently Asked Questions

What is CVE-2019-9514?

CVE-2019-9514 is a security vulnerability in Golang.org/x/net involving golang.org/x/net/http vulnerable to a reset flood under CWE-400: Uncontrolled Resource Consumption.

Which Golang.org/x/net versions are affected?

Affected versions include releases prior to 0.0.0-20190813141303-74dc4d7220e7 across affected packages: golang.org/x/net.

What version fixes CVE-2019-9514?

Upgrading to 0.0.0-20190813141303-74dc4d7220e7 (or the latest patched release for your respective branch) resolves the vulnerability.

Is golang.org/x/net affected?

Yes, golang.org/x/net is affected in releases prior to 0.0.0-20190813141303-74dc4d7220e7. Upgrade your dependency to 0.0.0-20190813141303-74dc4d7220e7 or later.

What is the CVSS score of CVE-2019-9514?

CVE-2019-9514 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

What CWE is associated with CVE-2019-9514?

CVE-2019-9514 is classified under CWE-400: Uncontrolled Resource Consumption (The product does not properly control the allocation and maintenance of a limited resource.).

How can I check Go dependencies for CVE-2019-9514?

Run the dependency tree command: 'inspect dependencies for golang.org/x/net'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-39qc-96h7-956f",
  "modified" : "2024-05-20T21:30:41Z",
  "published" : "2022-05-24T16:53:19Z",
  "aliases" : [ "CVE-2019-9514" ],
  "summary" : "golang.org/x/net/http vulnerable to a reset flood",
  "details" : "Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.\n\n### Specific Go Packages Affected\ngolang.org/x/net/http2",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "golang.org/x/net"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20190813141303-74dc4d7220e7"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2019-9514"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:2594"
  }, {
    "type" : "WEB",
    "url" : "https://go.dev/cl/190137"
  }, {
    "type" : "WEB",
    "url" : "https://go.dev/issue/33606"
  }, {
    "type" : "WEB",
    "url" : "https://go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5"
  }, {
    "type" : "WEB",
    "url" : "https://groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ"
  }, {
    "type" : "WEB",
    "url" : "https://kb.cert.org/vuls/id/605641"
  }, {
    "type" : "WEB",
    "url" : "https://kc.mcafee.com/corporate/index?page=content&id=SB10296"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04@%3Cusers.trafficserver.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19@%3Cannounce.trafficserver.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7@%3Cdev.trafficserver.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2022-0536"
  }, {
    "type" : "WEB",
    "url" : "https://seclists.org/bugtraq/2019/Aug/24"
  }, {
    "type" : "WEB",
    "url" : "https://seclists.org/bugtraq/2019/Aug/31"
  }, {
    "type" : "WEB",
    "url" : "https://seclists.org/bugtraq/2019/Aug/43"
  }, {
    "type" : "WEB",
    "url" : "https://seclists.org/bugtraq/2019/Sep/18"
  }, {
    "type" : "WEB",
    "url" : "https://security.netapp.com/advisory/ntap-20190823-0001"
  }, {
    "type" : "WEB",
    "url" : "https://security.netapp.com/advisory/ntap-20190823-0004"
  }, {
    "type" : "WEB",
    "url" : "https://security.netapp.com/advisory/ntap-20190823-0005"
  }, {
    "type" : "WEB",
    "url" : "https://support.f5.com/csp/article/K01988340"
  }, {
    "type" : "WEB",
    "url" : "https://support.f5.com/csp/article/K01988340?utm_source=f5support&amp;utm_medium=RSS"
  }, {
    "type" : "WEB",
    "url" : "https://usn.ubuntu.com/4308-1"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2019/dsa-4503"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2019/dsa-4508"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2019/dsa-4520"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2020/dsa-4669"
  }, {
    "type" : "WEB",
    "url" : "https://www.synology.com/security/advisory/Synology_SA_19_33"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:2661"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:2682"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:2690"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:2726"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:2766"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:2769"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:2796"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:2861"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:2925"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:2939"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:2955"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:2966"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:3131"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:3245"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:3265"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:3892"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:3906"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:4018"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:4019"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:4020"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:4021"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:4040"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:4041"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:4042"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:4045"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:4269"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:4273"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:4352"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2020:0406"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2020:0727"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html"
  }, {
    "type" : "WEB",
    "url" : "http://seclists.org/fulldisclosure/2019/Aug/16"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2019/08/20/1"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/10/18/8"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400", "CWE-770" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-02-08T00:30:39Z",
    "nvd_published_at" : "2019-08-13T21:15:00Z"
  }
}

CVSS V3

7.5 HIGH

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity None (I:N)

Availability High (A:H)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Advisory Metadata

Source ID: GHSA-39qc-96h7-956f
Schema Version: 1.4.0
Published: 2022-05-24 16:53
Last Modified: 2024-05-20 21:30
Database Record File: advisories/github-reviewed/2022/05/GHSA-39qc-96h7-956f/GHSA-39qc-96h7-956f.json