SB2022031318 - Multiple HTTP/2 DoS vulnerabilities in Twisted web server

Description

This security bulletin contains information about 3 vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2019-9512)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of user-supplied input when processing HTTP/2 requests. A remote attacker can send specially crafted HTTP packets to the affected system trigger resource exhaustion and perform a denial of service (DoS) attack.

2) Resource exhaustion (CVE-ID: CVE-2019-9514)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of user-supplied input when processing HTTP/2 requests. A remote attacker can send specially crafted HTTP packets to the affected system trigger resource exhaustion and perform a denial of service (DoS) attack.

3) Resource management error (CVE-ID: CVE-2019-9515)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in HTTP/2 implementation when processing SETTINGS frames. A remote attacker can send a huge amount of  SETTINGS frames to the peer and consume excessive CPU and memory on the system.

Remediation

Install update from vendor's website.

References

• https://github.com/twisted/twisted/security/advisories/GHSA-32gv-6cf3-wcmq