Lucene search
AmazonALAS-2023-1869HistoryOct 16, 2023 - 1:45 p.m.
Important: nghttp2
2023-10-1613:45:00
alas.aws.amazon.com
38
http/2
nghttp2
denial of service
cve-2023-44487
update
red hat
mitre
unix
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.813
Percentile
98.4%
Issue Overview:
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)
Affected Packages:
nghttp2
Issue Correction:
Run yum update nghttp2 to update your system.
New Packages:
i686:
nghttp2-1.33.0-1.1.8.amzn1.i686
nghttp2-debuginfo-1.33.0-1.1.8.amzn1.i686
libnghttp2-devel-1.33.0-1.1.8.amzn1.i686
libnghttp2-1.33.0-1.1.8.amzn1.i686
src:
nghttp2-1.33.0-1.1.8.amzn1.src
x86_64:
nghttp2-1.33.0-1.1.8.amzn1.x86_64
libnghttp2-devel-1.33.0-1.1.8.amzn1.x86_64
libnghttp2-1.33.0-1.1.8.amzn1.x86_64
nghttp2-debuginfo-1.33.0-1.1.8.amzn1.x86_64
Additional References
Red Hat: CVE-2023-44487
Mitre: CVE-2023-44487
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 1 | i686 | nghttp2 | < 1.33.0-1.1.8.amzn1 | nghttp2-1.33.0-1.1.8.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | nghttp2-debuginfo | < 1.33.0-1.1.8.amzn1 | nghttp2-debuginfo-1.33.0-1.1.8.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | libnghttp2-devel | < 1.33.0-1.1.8.amzn1 | libnghttp2-devel-1.33.0-1.1.8.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | libnghttp2 | < 1.33.0-1.1.8.amzn1 | libnghttp2-1.33.0-1.1.8.amzn1.i686.rpm |
| Amazon Linux | 1 | x86_64 | nghttp2 | < 1.33.0-1.1.8.amzn1 | nghttp2-1.33.0-1.1.8.amzn1.x86_64.rpm |
| Amazon Linux | 1 | x86_64 | libnghttp2-devel | < 1.33.0-1.1.8.amzn1 | libnghttp2-devel-1.33.0-1.1.8.amzn1.x86_64.rpm |
| Amazon Linux | 1 | x86_64 | libnghttp2 | < 1.33.0-1.1.8.amzn1 | libnghttp2-1.33.0-1.1.8.amzn1.x86_64.rpm |
| Amazon Linux | 1 | x86_64 | nghttp2-debuginfo | < 1.33.0-1.1.8.amzn1 | nghttp2-debuginfo-1.33.0-1.1.8.amzn1.x86_64.rpm |
Related
alpinelinux
alpinelinux
CVE-2023-44487
2023-10-10 14:15:10
nessus
nessus
FreeBSD : h2o -- HTTP/2 Rapid Reset attack vulnerability (bf545001-b96d-42e4-9d2e-60fdee204a43)
2023-10-10 00:00:00
Security Updates for Microsoft ASP.NET Core (October 2023)
2023-10-12 00:00:00
Security Update for Microsoft .NET 6 Core (October 2023)
2023-10-13 00:00:00
redhat
redhat
(RHSA-2023:5714) Moderate: nginx security update
2023-10-16 08:07:21
(RHSA-2023:5705) Important: rh-dotnet60-dotnet security, bug fix, and enhancement update
2023-10-16 08:00:49
(RHSA-2023:5766) Important: nghttp2 security update
2023-10-17 08:49:06
almalinux
almalinux
Important: dotnet7.0 security update
2023-10-16 00:00:00
Important: tomcat security update
2023-10-19 00:00:00
Moderate: nginx:1.22 security update
2023-10-25 00:00:00
rocky
rocky
.NET 7.0 security update
2023-10-24 18:36:50
nghttp2 security update
2023-11-11 23:00:24
dotnet6.0 security update
2023-10-24 18:36:50
fedora
fedora
[SECURITY] Fedora 37 Update: cachelib-17^20231016-1.fc37
2023-10-24 01:13:17
[SECURITY] Fedora 37 Update: folly-2023.10.16.00-1.fc37
2023-10-24 01:13:18
[SECURITY] Fedora 37 Update: mcrouter-0.41.0.20231016-1.fc37
2023-10-24 01:13:18
cbl_mariner
cbl_mariner
CVE-2023-44487 affecting package grpc for versions less than 1.42.0-7
2024-03-21 08:27:20
CVE-2023-44487 affecting package skopeo for versions less than 1.12.0-4
2024-02-25 03:00:06
ibm
ibm
oraclelinux
oraclelinux
nghttp2 security update
2023-10-19 00:00:00
nodejs:16 security update
2023-10-20 00:00:00
nodejs security update
2023-10-20 00:00:00
talosblog
talosblog
impervablog
impervablog
HTTP/2 Rapid Reset Mitigation With Imperva WAF
2024-01-03 14:21:45
osv
osv
BIT-dotnet-2023-44487
2024-03-06 10:52:07
BIT-aspnet-core-2023-44487
2024-03-06 10:50:59
Important: dotnet6.0 security update
2023-10-24 18:36:50
openvas
openvas
Huawei EulerOS: Security Advisory for nginx (EulerOS-SA-2024-1154)
2024-02-09 00:00:00
Fedora: Security Advisory for folly (FEDORA-2023-17efd3f2cd)
2023-10-25 00:00:00
Fedora: Security Advisory for wdt (FEDORA-2023-17efd3f2cd)
2023-10-25 00:00:00
cnvd
cnvd
F5 BIG-IP Denial of Service Vulnerability (CNVD-2023-75597)
2023-10-11 00:00:00
cisa_kev
cisa_kev
HTTP/2 Rapid Reset Attack Vulnerability
2023-10-10 00:00:00
atlassian
atlassian
cisco
cisco
HTTP/2 Rapid Reset Attack Affecting Cisco Products: October 2023
2023-10-16 16:00:00
debian
debian
[SECURITY] [DLA 3656-1] netty security update
2023-11-19 20:45:02
cgr
cgr
CVE-2023-44487 vulnerabilities
2024-05-19 03:07:16
debiancve
debiancve
CVE-2023-44487
2023-10-10 14:15:10
github
github
github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset
2023-10-10 18:23:21
githubexploit
githubexploit
Exploit for Uncontrolled Resource Consumption in Ietf Http
2023-10-11 01:59:47
Exploit for Uncontrolled Resource Consumption in Ietf Http
2023-10-10 14:20:42
hivepro
hivepro
Attacks, Vulnerabilities and Actors 9 October to 15 October 2023
2023-10-17 09:10:10
HTTP2 Zero-Day Exploited for the Most Explosive DDoS Attacks
2023-10-12 08:09:28
gitlab
gitlab
HTTP/2 Stream Cancellation Attack
2023-10-10 00:00:00
nvd
nvd
CVE-2023-44487
2023-10-10 14:15:10
cve
cve
CVE-2023-44487
2023-10-10 14:15:10
redos
redos
ROS-20240503-02
2024-05-03 00:00:00
wolfi
wolfi
CVE-2023-44487 vulnerabilities
2024-09-20 09:11:51
ubuntu
ubuntu
.NET vulnerability
2023-10-10 00:00:00
amazon
amazon
Important: nginx
2023-10-16 13:45:00
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.813
Percentile
98.4%
Related for ALAS-2023-1869