Lucene search
AlmaLinuxALSA-2024:2368HistoryApr 30, 2024 - 12:00 a.m.
Moderate: mod_http2 security update
2024-04-3000:00:00
errata.almalinux.org
3
mod_http2
apache httpd
security update
http/2
libnghttp2
cve-2023-43622
cve-2023-44487
cve-2023-45802
cvss score
almalinux
release notes
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.7 High
AI Score
Confidence
High
0.732 High
EPSS
Percentile
98.1%
The mod_http2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.
Security Fix(es):
- httpd: mod_http2: DoS in HTTP/2 with initial window size 0 (CVE-2023-43622)
- mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487) (CVE-2023-45802)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| almalinux | 9 | x86_64 | mod_http2 | < 2.0.26-1.el9 | mod_http2-2.0.26-1.el9.x86_64.rpm |
| almalinux | 9 | ppc64le | mod_http2 | < 2.0.26-1.el9 | mod_http2-2.0.26-1.el9.ppc64le.rpm |
| almalinux | 9 | aarch64 | mod_http2 | < 2.0.26-1.el9 | mod_http2-2.0.26-1.el9.aarch64.rpm |
| almalinux | 9 | s390x | mod_http2 | < 2.0.26-1.el9 | mod_http2-2.0.26-1.el9.s390x.rpm |
Related
redhat
redhat
(RHSA-2024:2368) Moderate: mod_http2 security update
2024-04-30 06:15:30
(RHSA-2024:2891) Moderate: httpd:2.4 security update
2024-05-16 11:37:17
(RHSA-2024:3121) Moderate: httpd:2.4 security update
2024-05-22 06:35:40
nessus
nessus
RHEL 9 : mod_http2 (RHSA-2024:2368)
2024-04-30 00:00:00
Apache 2.4.x < 2.4.58 Multiple Vulnerabilities
2023-10-19 00:00:00
Oracle Linux 9 : mod_http2 (ELSA-2024-2368)
2024-05-06 00:00:00
osv
osv
Moderate: mod_http2 security update
2024-04-30 00:00:00
CVE-2023-45802
2023-10-23 07:15:11
BIT-2023-45802
2023-11-02 07:16:21
oraclelinux
oraclelinux
mod_http2 security update
2024-05-02 00:00:00
httpd:2.4 security update
2024-05-24 00:00:00
.NET 7.0 security update
2023-10-18 00:00:00
mageia
mageia
Updated apache packages fix security vulnerabilities
2023-10-28 00:49:40
openvas
openvas
Mageia: Security Advisory (MGASA-2023-0304)
2023-10-30 00:00:00
Apache HTTP Server 2.4.17 - 2.4.57 DoS Vulnerability - Linux
2023-10-19 00:00:00
Fedora: Security Advisory for mod_http2 (FEDORA-2023-0259c3f26f)
2023-10-25 00:00:00
redhatcve
redhatcve
CVE-2023-45802
2023-10-19 19:44:57
CVE-2023-43622
2023-10-20 10:56:55
nvd
nvd
CVE-2023-45802
2023-10-23 07:15:11
CVE-2023-43622
2023-10-23 07:15:11
fedora
fedora
[SECURITY] Fedora 38 Update: mod_http2-2.0.25-1.fc38
2023-10-24 01:23:54
[SECURITY] Fedora 39 Update: mod_http2-2.0.25-1.fc39
2023-11-07 01:40:03
[SECURITY] Fedora 37 Update: mod_http2-2.0.25-1.fc37
2023-11-07 02:32:37
cvelist
cvelist
alpinelinux
alpinelinux
CVE-2023-45802
2023-10-23 07:15:11
CVE-2023-43622
2023-10-23 07:15:11
debiancve
debiancve
CVE-2023-45802
2023-10-23 07:15:11
CVE-2023-43622
2023-10-23 07:15:11
ubuntucve
ubuntucve
CVE-2023-45802
2023-10-23 00:00:00
CVE-2023-43622
2023-10-23 00:00:00
attackerkb
attackerkb
CVE-2023-44487
2023-10-10 00:00:00
cve
cve
CVE-2023-45802
2023-10-23 07:15:11
CVE-2023-43622
2023-10-23 07:15:11
prion
prion
Design/Logic Flaw
2023-10-23 07:15:00
Code injection
2023-10-23 07:15:00
f5
f5
K000137327 : Apache mod_http2 vulnerability CVE-2023-45802
2023-10-23 00:00:00
K000137325 : Apache httpd vulnerability CVE-2023-43622
2023-10-23 00:00:00
amazon
amazon
Important: httpd24
2023-10-30 23:31:00
Important: httpd
2023-10-30 23:59:00
Important: nghttp2
2023-10-16 13:45:00
freebsd
freebsd
Apache httpd -- Multiple vulnerabilities
2023-10-19 00:00:00
www/varnish7 -- Denial of Service
2019-04-19 00:00:00
ubuntu
ubuntu
Apache HTTP Server vulnerabilities
2023-11-22 00:00:00
slackware
slackware
[slackware-security] httpd
2023-10-19 19:21:22
kaspersky
kaspersky
KLA61504 Multiple vulnerabilities in Apache HTTP Server
2023-10-19 00:00:00
almalinux
almalinux
Moderate: httpd:2.4 security update
2024-05-22 00:00:00
Important: dotnet6.0 security update
2023-10-16 00:00:00
Important: varnish security update
2023-10-19 00:00:00
rocky
rocky
httpd:2.4 security update
2024-06-14 13:59:30
varnish security update
2023-10-24 18:36:42
varnish security update
2023-10-24 18:35:47
photon
photon
Important Photon OS Security Update - PHSA-2023-4.0-0502
2023-11-01 00:00:00
Important Photon OS Security Update - PHSA-2023-3.0-0680
2023-11-03 00:00:00
veracode
veracode
Denial Of Service (DoS)
2023-10-21 07:38:44
Denial Of Service (DoS)
2023-10-20 07:48:32
redos
redos
ROS-20240423-01
2024-04-23 00:00:00
ROS-20231030-05
2023-10-30 00:00:00
ROS-20231107-01
2023-11-07 00:00:00
cbl_mariner
cbl_mariner
CVE-2023-43622 affecting package httpd for versions less than 2.4.58-1
2023-11-08 02:07:28
CVE-2023-45802 affecting package httpd for versions less than 2.4.58-1
2023-11-08 02:07:28
debian
debian
[SECURITY] [DSA 5662-1] apache2 security update
2024-04-16 18:32:07
[SECURITY] [DLA 3638-1] h2o security update
2023-10-31 14:09:23
[SECURITY] [DLA 3617-2] tomcat9 regression update
2023-10-16 22:23:23
atlassian
atlassian
github
github
HTTP/2 Stream Cancellation Attack
2023-10-10 21:28:24
githubexploit
githubexploit
Exploit for Uncontrolled Resource Consumption in Ietf Http
2023-12-11 23:12:03
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.7 High
AI Score
Confidence
High
0.732 High
EPSS
Percentile
98.1%
Related for ALSA-2024:2368