CVE-2019-11479 — Oracle
HIGHCVE-2019-11479 is a high-severity (CVSS 7.5) CWE-405 vulnerability. EPSS puts its 30-day exploitation probability at 91.7% (100th percentile). No vendor fix is recorded yet; mitigation options are listed below.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2019-11479 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).
Where this sits among everything scored
Of 398,142 CVEs with a current EPSS score, this one falls in the ≥ 90% band (highlighted). Counts from FIRST.org, log-scaled.
Description
Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.
Affected Products
ubuntu linuxcanonicalbig-ip access policy managerf5big-ip advanced firewall managerf5big-ip analyticsf5big-ip application acceleration managerf5big-ip application security managerf5Detection & mitigation playbook
VulnerabilityDetect
Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).
Remediation status
No fixed release is recorded for CVE-2019-11479 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.
Mitigate without a patch
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/security/vulnerabilities/tcpsack Red Hat Enterprise Linux 5 is now in the Extended Life Phase of maintenance life…
For mitigation, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/security/vulnerabilities/tcpsackSource: Red Hat security advisory for CVE-2019-11479 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Enterprise Linux 6 | kernel-0:2.6.32-754.15.3.el6 | RHSA-2019:1488 |
| Red Hat Enterprise Linux 6.5 Advanced Update Support | kernel-0:2.6.32-431.95.3.el6 | RHSA-2019:1490 |
| Red Hat Enterprise Linux 6.6 Advanced Update Support | kernel-0:2.6.32-504.79.3.el6 | RHSA-2019:1489 |
| Red Hat Enterprise Linux 7 | kernel-rt-0:3.10.0-957.21.3.rt56.935.el7 | RHSA-2019:1486 |
| Red Hat Enterprise Linux 7 | kernel-0:3.10.0-957.21.3.el7 | RHSA-2019:1481 |
| Red Hat Enterprise Linux 7 | kernel-alt-0:4.14.0-115.8.2.el7a | RHSA-2019:1602 |
| Red Hat Enterprise Linux 7.2 Advanced Update Support | kernel-0:3.10.0-327.79.2.el7 | RHSA-2019:1485 |
| Red Hat Enterprise Linux 7.3 Advanced Update Support | kernel-0:3.10.0-514.66.2.el7 | RHSA-2019:1484 |
Frequently Asked Questions
Is CVE-2019-11479 in your dependencies?
Find it across , including transitive dependencies.