Fixes are available
APAR status
-
Closed as program error.
Error description
-
Address CVE-2019-9511 Data Dribble and CVE-2019-9513 Resource Loop in nghttp2. Specially crafted HTTP/2 frames might cause Denial of Service by consuming CPU time.
Local fix
Problem summary
-
DataPower CPU might going high due to Denial-of-Service attack by the vulnerabilities CVE-2019-9511 and CVE-2019-9513.
Problem conclusion
-
Fix is available in 7.6.0.17 and 2018.4.1.8 For a list of the latest fix packs available, please see: http://www-01.ibm.com/support/docview.wss?uid=swg21237631
Temporary fix
Comments
APAR Information
-
APAR number
IT30266
-
Reported component name
DATAPOWER
-
Reported component ID
DP1234567
-
Reported release
760
-
Status
CLOSED PER
-
PE
NoPE
-
HIPER
NoHIPER
-
Special Attention
NoSpecatt / Xsystem
-
Submitted date
2019-09-12
-
Closed date
2019-10-15
-
Last modified date
2019-10-17
-
APAR is sysrouted FROM one or more of the following:
-
APAR is sysrouted TO one or more of the following:
Fix information
-
Fixed component name
DATAPOWER
-
Fixed component ID
DP1234567
Applicable component levels
[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SS9H2Y","label":"IBM DataPower Gateway"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"LOB45","label":"Automation"}}]
Document Information
Modified date:
08 June 2021