HTTP/2 vulnerabilities (CVE-2019-9511 ~ CVE-2019-9518)

Products

• CA API Gateway

Issue/Introduction

Regarding the eight CVEs below on HTTP/2, does each vulnerability have any impact on the product?

(1) CVE-2019-9511 HTTP/2 Data Dribble

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-9511

(2) CVE-2019-9512 HTTP/2 Ping Flood

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-9512

(3) CVE-2019-9513 HTTP/2 Resource Loop

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-9513

(4) CVE-2019-9514 HTTP/2 Reset Flood

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-9514

(5) CVE-2019-9515 HTTP/2 Settings Flood

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-9515

(6) CVE-2019-9516 HTTP/2 0-Length Headers Leak

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-9516

(7) CVE-2019-9517 HTTP/2 Internal Data Buffering

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-9517

(8) CVE-2019-9518 HTTP/2 Request Data/Header Flood

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-9518

Environment

Release : ALL

Component : API GATEWAY

Resolution

We don't have support for HTTP/2 yet in any released version of Gateway. So, API Gateway should not be affected by those HTTP/2 CVEs.

Note: HTTP/2 support is planned to be released with 9.5. 

Additional Information

Support for HTTP/2