Various HTTP2 CVEs: Some Cloud Foundry products are impacted by HTTP denial of service attacks

Severity

High

Vendor

Cloud Foundry Foundation

Description

Some Cloud Foundry products, through their consumption of imperfect HTTP2 implementations, are impacted by various HTTP vulnerabilities, including Data Dribble, Ping Flood, Resource Loop, Reset Flood, Settings Flood, 0-Length Headers Leak, Internal Data Buffering, and Empty Frames Flood. A remote attacker could cause a denial of service by exploiting these weaknesses.

Affected Cloud Foundry Products and Versions

• CF Deployment
  • All versions prior to v12.2.0
• Xenial Stemcells
  • 97 versions prior to 97.151
  • 170 versions prior to 170.124
  • 250 versions prior to 250.99
  • 315 versions prior to 315.89
  • 456 versions prior to 456.16
• BOSH Deployment
  • All versions prior to 270.6.0
• Diego (OSS)
  • All versions prior to v2.37.0
• CredHub CLI
  • All versions prior to 2.5.3
• CAPI (OSS)
  • All versions prior to 1.87.0
• Garden-runC
  • All versions prior to v1.19.7

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• CF Deployment
  • Upgrade All versions to v12.2.0 or greater
• Xenial Stemcells
  • Upgrade 97 versions to 97.151 or greater
  • Upgrade 315 versions to 315.89 or greater
  • Upgrade 456 versions to 456.16 or greater
  • Upgrade 170 versions to 170.124 or greater
  • Upgrade 250 versions to 250.99 or greater
• BOSH Deployment
  • Upgrade All versions to 270.6.0 or greater
• Diego (OSS)
  • Upgrade All versions to v2.37.0 or greater
• CredHub CLI
  • Upgrade All versions to 2.5.3 or greater
• CAPI (OSS)
  • Upgrade All versions to 1.87.0 or greater
• Garden-runC
  • Upgrade All versions to v1.19.7 or greater

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-CVE-2019-9511
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-CVE-2019-9512
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-CVE-2019-9513
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-CVE-2019-9514
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-CVE-2019-9515
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-CVE-2019-9516
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-CVE-2019-9517
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-CVE-2019-9518

History

2019-12-03: Initial vulnerability report published.