Read the docs
TI-2019-06949 Aliases CVE-2019-9514GHSA-39qc-96h7-956f

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a…

Priority HIGH 74CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 35 fixed, 11 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

Why it matters now

EPSS 0.82813 99th percentileScored 2026-11-07
Fix Partial golang.org/x/net (Go): 0.0.0-20190813141303-74dc4d7220e7Red Hat: 40 advisoriesRed Hat: 35 fixed, 11 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—golang.org/x/net (Go)before 0.0.0-20190813141303-74dc4d7220e70.0.0-20190813141303-74dc4d7220e7Patch availableGHSA-39qc-96h7-956f
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • golang.org/x/net (Go) Vendor— Affected before 0.0.0-20190813141303-74dc4d7220e7 Fixed in 0.0.0-20190813141303-74dc4d7220e7 Patch available GHSA-39qc-96h7-956f

CPE configurations NVD · 45

CPEVersionsRoleVendor
cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:*1.0.0 – 1.4.0VulnerableApple
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*10.12Running onApple
cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*14.04Running onCanonical
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*6.0.0 – 6.2.3; 7.0.0 – 7.1.6; 8.0.0 – 8.0.3VulnerableApache
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*19.04VulnerableCanonical
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:synology:skynas:-:*:*:*:*:*:*:*not specified by NVDVulnerableSynology
  • cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:* Versions 1.0.0 – 1.4.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions 10.12 Running on ·Apple
  • cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:* Versions 14.04 Running on ·Canonical
  • cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:* Versions 6.0.0 – 6.2.3; 7.0.0 – 7.1.6; 8.0.0 – 8.0.3 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:synology:skynas:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Synology
Show 35 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:*6.2VulnerableSynology
cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableSynology
cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:*not specified by NVDRunning onSynology
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*29VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*15.0VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:a:redhat:developer_tools:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*7.2.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:*7.3.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:3.9:*:*:*:*:*:*:*3.9VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:3.10:*:*:*:*:*:*:*3.10VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*3.11VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*4.1VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:*4.2VulnerableRed Hat
cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*14VulnerableRed Hat
cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*8.1VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:oracle:graalvm:19.2.0:*:*:*:enterprise:*:*:*19.2.0VulnerableOracle
cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*7.7.2.0 to before 7.7.2.24; 7.8.2.0 to before 7.8.2.13; 8.1.0 to before 8.2.0VulnerableMcAfee
cpe:2.3:a:netapp:cloud_insights:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:trident:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*11.6.1 to before 11.6.5.1; 12.1.0 to before 12.1.5.1; 13.1.0 to before 13.1.3.2; 14.0.0 to before 14.0.1.1; 14.1.0 to before 14.1.2.1; 15.0.0 to before 15.0.1.1VulnerableF5
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*8.0.0 – 8.8.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*8.9.0 to before 8.16.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*10.0.0 – 10.12.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*10.13.0 to before 10.16.3VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*12.0.0 to before 12.8.1VulnerableNodeJS
  • cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Synology
  • cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Synology
  • cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Synology
  • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:a:redhat:developer_tools:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:3.9:*:*:*:*:*:*:* Versions 3.9 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:3.10:*:*:*:*:*:*:* Versions 3.10 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:* Versions 14 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:oracle:graalvm:19.2.0:*:*:*:enterprise:*:*:* Versions 19.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:* Versions 7.7.2.0 to before 7.7.2.24; 7.8.2.0 to before 7.8.2.13; 8.1.0 to before 8.2.0 Vulnerable ·McAfee
  • cpe:2.3:a:netapp:cloud_insights:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:trident:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* Versions 11.6.1 to before 11.6.5.1; 12.1.0 to before 12.1.5.1; 13.1.0 to before 13.1.3.2; 14.0.0 to before 14.0.1.1; 14.1.0 to before 14.1.2.1; 15.0.0 to before 15.0.1.1 Vulnerable ·F5
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 8.0.0 – 8.8.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 8.9.0 to before 8.16.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 10.0.0 – 10.12.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 10.13.0 to before 10.16.3 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 12.0.0 to before 12.8.1 Vulnerable ·NodeJS

Remediation

  • Fix · GHSA-39qc-96h7-956f golang.org/x/net (Go) Fixed in 0.0.0-20190813141303-74dc4d7220e7 Advisory →

Red Hat 40 advisories

  • RHSA-2024:5856 Released 2024-08-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-commons-beanutils-1.9.4-1.redhat_00002.1.ep7.el7, eap7-infinispan-8.2.11-1.SP2_redhat_00001.1.ep7.el7, eap7-infinispan-cachestore-jdbc-8.2.11-1.SP2_redhat_00001.1.ep7.el7 +12
  • RHSA-2020:3197 Released 2020-07-29 · Red Hat rating Important
    Red Hat Process Automation Manager 7.8.0 Security Update
    • Red Hat Process Automation 7
  • RHSA-2020:3196 Released 2020-07-29 · Red Hat rating Important
    Red Hat Decision Manager 7.8.0 Security Update
    • Red Hat Decision Manager 7
Show 37 more Red Hat advisories
  • RHSA-2020:2565 Released 2020-06-15 · Red Hat rating Important
    EAP Continuous Delivery Technical Preview Release 18 security update
    • Red Hat JBoss Enterprise Application Platform Continuous Delivery
  • RHSA-2020:2067 Released 2020-05-18 · Red Hat rating Important
    Red Hat build of Thorntail 2.5.1 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2020:1445 Released 2020-04-14 · Red Hat rating Important
    Red Hat AMQ Broker 7.4.3 release and security update
    • Red Hat AMQ 7.4.3
  • RHSA-2020:0983 Released 2020-03-26 · Red Hat rating Important
    Red Hat Fuse 7.6.0 security update
    • Red Hat Fuse 7.6.0
  • RHSA-2020:0922 Released 2020-03-23 · Red Hat rating Important
    Red Hat AMQ Broker 7.6 release and security update
    • Red Hat AMQ
  • RHSA-2020:0727 Released 2020-03-05 · Red Hat rating Important
    Red Hat Data Grid 7.3.3 security update
    • Red Hat Data Grid 7.3.3
  • RHSA-2020:0406 Released 2020-02-04 · Red Hat rating Important
    containernetworking-plugins security update
    • Red Hat Enterprise Linux 7 Extras containernetworking-plugins-0.8.1-4.el7_7
  • RHSA-2019:4352 Released 2019-12-19 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.3 R14 security and bug fix update
    • Red Hat Fuse 6.3
  • RHSA-2019:4269 Released 2019-12-17 · Red Hat rating Important
    container-tools:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8.aarch64::container-tools:rhel8, buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8.ppc64le::container-tools:rhel8, buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8.s390x::container-tools:rhel8 +47
  • RHSA-2019:4273 Released 2019-12-17 · Red Hat rating Important
    container-tools:1.0 security update
    • Red Hat Enterprise Linux AppStream (v. 8) buildah-1.5-6.gite94b4f9.module+el8.1.0+4908+72a45cef.aarch64::container-tools:1.0, buildah-1.5-6.gite94b4f9.module+el8.1.0+4908+72a45cef.ppc64le::container-tools:1.0, buildah-1.5-6.gite94b4f9.module+el8.1.0+4908+72a45cef.s390x::container-tools:1.0 +47
  • RHSA-2019:4045 Released 2019-12-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.5 security update
    • Red Hat Single Sign-On 7.3
  • RHSA-2019:4042 Released 2019-12-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.5 security update on RHEL 8
    • Red Hat Single Sign-On 7.3 for RHEL 8 rh-sso7-keycloak-4.8.15-1.Final_redhat_00001.1.el8sso, rh-sso7-keycloak-server-4.8.15-1.Final_redhat_00001.1.el8sso
  • RHSA-2019:4040 Released 2019-12-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.5 security update on RHEL 6
    • Red Hat Single Sign-On 7.3 for RHEL 6 Server rh-sso7-keycloak-4.8.15-1.Final_redhat_00001.1.el6sso, rh-sso7-keycloak-server-4.8.15-1.Final_redhat_00001.1.el6sso
  • RHSA-2019:4041 Released 2019-12-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.5 security update on RHEL 7
    • Red Hat Single Sign-On 7.3 for RHEL 7 Server rh-sso7-keycloak-4.8.15-1.Final_redhat_00001.1.el7sso, rh-sso7-keycloak-server-4.8.15-1.Final_redhat_00001.1.el7sso
  • RHSA-2019:4019 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-apache-cxf-3.2.10-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.2.10-1.redhat_00001.1.el7eap, eap7-apache-cxf-services-3.2.10-1.redhat_00001.1.el7eap +47
  • RHSA-2019:4021 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 security update
    • Red Hat JBoss EAP 7.2
  • RHSA-2019:4020 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-apache-cxf-3.2.10-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.2.10-1.redhat_00001.1.el8eap, eap7-apache-cxf-services-3.2.10-1.redhat_00001.1.el8eap +47
  • RHSA-2019:4018 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-apache-cxf-3.2.10-1.redhat_00001.1.el6eap, eap7-apache-cxf-rt-3.2.10-1.redhat_00001.1.el6eap, eap7-apache-cxf-services-3.2.10-1.redhat_00001.1.el6eap +47
  • RHSA-2019:3906 Released 2019-11-18 · Red Hat rating Important
    OpenShift Container Platform 3.11 HTTP/2 security update
    • Red Hat OpenShift Container Platform 3.11 atomic-enterprise-service-catalog-1:3.11.154-1.git.1.fa68ced.el7, atomic-enterprise-service-catalog-svcat-1:3.11.154-1.git.1.fa68ced.el7, atomic-openshift-cluster-autoscaler-3.11.154-1.git.1.532da7a.el7 +32
  • RHSA-2019:3892 Released 2019-11-14 · Red Hat rating Important
    Red Hat Fuse 7.5.0 security update
    • Red Hat Fuse 7.5.0
  • RHSA-2019:3265 Released 2019-10-30 · Red Hat rating Important
    OpenShift Container Platform 4.1 security update
    • Red Hat OpenShift Container Platform 4.1 ansible-operator-0.0.1-3.git.59.4beb3d2.el7, ansible-operator-container-scripts-0.0.1-3.git.59.4beb3d2.el7, ansible-operator-devel-0.0.1-3.git.59.4beb3d2.el7 +8
  • RHSA-2019:3245 Released 2019-10-29 · Red Hat rating Important
    OpenShift Container Platform 4.2 security update
    • Red Hat OpenShift Container Platform 4.2 apb-2.0.3-2.el7, apb-container-scripts-2.0.3-2.el7, apb-devel-2.0.3-2.el7 +3
  • RHSA-2019:2769 Released 2019-10-24 · Red Hat rating Important
    OpenShift Container Platform 3.9 security update
    • Red Hat OpenShift Container Platform 3.9 ansible-service-broker-1.1.20-2.el7, ansible-service-broker-container-scripts-1.1.20-2.el7, ansible-service-broker-selinux-1.1.20-2.el7 +44
  • RHSA-2019:3131 Released 2019-10-16 · Red Hat rating Important
    OpenShift Container Platform 4.1.20 golang security update
    • Red Hat OpenShift Container Platform 4.1 cri-o-1.13.11-0.10.dev.rhaos4.1.gitbdeb2ca.el7, cri-o-1.13.11-0.13.dev.rhaos4.1.gitbdeb2ca.el8, cri-tools-1.13.0-2.rhaos4.1.gitc06001f.el7 +12
  • RHSA-2019:2966 Released 2019-10-03 · Red Hat rating Important
    Red Hat Quay v3.1.1 security update
    • Quay v3 quay3/clair-jwt
  • RHSA-2019:2955 Released 2019-10-02 · Red Hat rating Important
    rh-nodejs8-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
  • RHSA-2019:2939 Released 2019-10-01 · Red Hat rating Important
    rh-nodejs10-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
  • RHSA-2019:2925 Released 2019-09-30 · Red Hat rating Important
    nodejs:10 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.aarch64::nodejs:10, nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.ppc64le::nodejs:10, nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.s390x::nodejs:10 +15
  • RHSA-2019:2861 Released 2019-09-26 · Red Hat rating Important
    OpenShift Container Platform 4.1.18 gRPC security update
    • Red Hat OpenShift Container Platform 4.1 openshift4/ose-sriov-network-device-plugin
  • RHSA-2019:2817 Released 2019-09-23 · Red Hat rating Moderate
    OpenShift Container Platform 3.11 security update
    • Red Hat OpenShift Container Platform 3.11 cri-o-1.11.16-0.2.dev.rhaos3.11.git3f89eba.el7
  • RHSA-2019:2796 Released 2019-09-19 · Red Hat rating Important
    skydive security update
    • Red Hat OpenStack Platform 14.0 skydive-0.20.5-2.el7ost, skydive-agent-0.20.5-2.el7ost, skydive-analyzer-0.20.5-2.el7ost +2
  • RHSA-2019:2766 Released 2019-09-12 · Red Hat rating Important
    Red Hat OpenShift Enterprise 4.1.15 gRPC security update
    • Red Hat OpenShift Container Platform 4.1 openshift4/ose-multus-cni, openshift4/ose-operator-lifecycle-manager, openshift4/ose-operator-registry
  • RHSA-2019:2726 Released 2019-09-12 · Red Hat rating Important
    go-toolset:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) go-toolset-1.11.13-1.module+el8.0.1+4087+d8180914.aarch64::go-toolset:rhel8, go-toolset-1.11.13-1.module+el8.0.1+4087+d8180914.ppc64le::go-toolset:rhel8, go-toolset-1.11.13-1.module+el8.0.1+4087+d8180914.s390x::go-toolset:rhel8 +16
  • RHSA-2019:2690 Released 2019-09-12 · Red Hat rating Important
    OpenShift Container Platform 3.10 security update
    • Red Hat OpenShift Container Platform 3.10 atomic-openshift-3.10.170-1.git.0.8e592d6.el7, atomic-openshift-clients-3.10.170-1.git.0.8e592d6.el7, atomic-openshift-clients-redistributable-3.10.170-1.git.0.8e592d6.el7 +10
  • RHSA-2019:2661 Released 2019-09-11 · Red Hat rating Important
    Red Hat OpenShift Container Platform 4.1 openshift RPM security update
    • Red Hat OpenShift Container Platform 4.1 atomic-enterprise-service-catalog-1:4.1.14-201908290858.git.1.28cc9ff.el7, atomic-enterprise-service-catalog-svcat-1:4.1.14-201908290858.git.1.28cc9ff.el7, openshift-4.1.14-201908290858.git.0.3bd3467.el7 +7
  • RHSA-2019:2682 Released 2019-09-10 · Red Hat rating Important
    go-toolset-1.11 and go-toolset-1.11-golang security update
    • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.11-1.11.13-1.el7, go-toolset-1.11-build-1.11.13-1.el7, go-toolset-1.11-golang-1.11.13-2.el7 +8
    • Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.11-1.11.13-1.el7, go-toolset-1.11-build-1.11.13-1.el7, go-toolset-1.11-golang-1.11.13-2.el7 +8
  • RHSA-2019:2594 Released 2019-09-10 · Red Hat rating Important
    OpenShift Container Platform 4.1.14 security and bug fix update
    • Red Hat OpenShift Container Platform 4.1 openshift4/apb-base, openshift4/mariadb-apb, openshift4/mediawiki +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat Ceph Storage 2AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 3AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat OpenShift Container Platform 3.10AffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenStack Platform 9 (Mitaka) Operational ToolsAffectedNo fix planned: Will not fix
Red Hat Quay 3AffectedNo fix yet
Red Hat Storage 3AffectedNo fix yet
Quay v3Fixed RHSA-2019:2966
Red Hat AMQFixed RHSA-2020:0922
Red Hat AMQ 7.4.3Fixed RHSA-2020:1445
Red Hat Data Grid 7.3.3Fixed RHSA-2020:0727
Red Hat Decision Manager 7Fixed RHSA-2020:3196
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:2682
Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:2682
Red Hat Enterprise Linux 7 ExtrasFixed RHSA-2020:0406
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2019:2726, RHSA-2019:2925, RHSA-2019:4269, RHSA-2019:4273
Red Hat Fuse 6.3Fixed RHSA-2019:4352
Red Hat Fuse 7.5.0Fixed RHSA-2019:3892
Red Hat Fuse 7.6.0Fixed RHSA-2020:0983
Red Hat JBoss EAP 7.2Fixed RHSA-2019:4021
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2019:4018
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2019:4019
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2019:4020
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2024:5856
Red Hat JBoss Enterprise Application Platform Continuous DeliveryFixed RHSA-2020:2565
Red Hat OpenShift Container Platform 3.10Fixed RHSA-2019:2690
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2019:2817, RHSA-2019:3906
Red Hat OpenShift Container Platform 3.9Fixed RHSA-2019:2769
Red Hat OpenShift Container Platform 4.1Fixed RHSA-2019:2594, RHSA-2019:2661, RHSA-2019:2766, RHSA-2019:2861, RHSA-2019:3131, RHSA-2019:3265
Red Hat OpenShift Container Platform 4.2Fixed RHSA-2019:3245
Red Hat OpenStack Platform 14.0Fixed RHSA-2019:2796
Red Hat Process Automation 7Fixed RHSA-2020:3197
Red Hat Single Sign-On 7.3Fixed RHSA-2019:4045
Red Hat Single Sign-On 7.3 for RHEL 6 ServerFixed RHSA-2019:4040
Red Hat Single Sign-On 7.3 for RHEL 7 ServerFixed RHSA-2019:4041
Red Hat Single Sign-On 7.3 for RHEL 8Fixed RHSA-2019:4042
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:2939, RHSA-2019:2955
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2019:2939, RHSA-2019:2955
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2019:2939, RHSA-2019:2955
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2019:2939, RHSA-2019:2955
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:2939, RHSA-2019:2955
Text-Only RHOARFixed RHSA-2020:2067
Not affected: 20 products
  • CloudForms Management Engine 5
  • OpenShift Service Mesh Tech Preview
  • Red Hat Ansible Tower 3
  • Red Hat Ceph Storage 2
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat OpenShift Container Platform 3.10
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 3.9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.1
  • Red Hat Process Automation 7
  • Red Hat Quay 3
  • Red Hat Single Sign-On 7
  • Red Hat Software Collections
  • Red Hat Storage 3
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-9514
  2. 2026-10-03 Alias added: GHSA-39qc-96h7-956f

References

Advisory 63

Other 23

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences