CVE-2019-9516

描述

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

如何修補 CVE-2019-9516

要修補 CVE-2019-9516,請將受影響套件升級到下列已修補版本。

• —升級至 1.16.1-r0 或更新版本
• —升級至 10.16.3-r0 或更新版本

CVE-2019-9516 正在被利用嗎?

可能 — EPSS 為 56.3%,屬於高被利用機率區間,建議優先修補。

受影響套件(2)

• >= 1.9.5, < 1.16.1-r0
• from 0, < 10.16.3-r0

CVSS 分數

參考連結(1)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2019-9516