Lucene search

IBM5FC77C735D64AF339AC7C3FB5DACA4531FC0BCE6CA7C1FCAA985AA0E0A234934

HistoryFeb 27, 2024 - 4:16 p.m.

Security Bulletin: Netty-codec-http2 is vulnerable to CVE-2023-44487 used in IBM Maximo Application Suite - Monitor Component

2024-02-2716:16:28

www.ibm.com

ibm maximo application suite

monitor component

cve-2023-44487

denial of service

netty-codec-http2

http/2 protocol

vulnerability

fixpack version

security bulletin

7.2 High

AI Score

Confidence

High

0.72 High

EPSS

Percentile

98.0%

JSON

Summary

IBM Maximo Application Suite - Monitor Component uses netty-codec-http2 which is vulnerable to CVE-2023-44487. This bulletin identifies the steps to take to address the vulnerability.

Vulnerability Details

CVEID:CVE-2023-44487
**DESCRIPTION:**Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling multiplexed streams in the HTTP/2 protocol. By sending numerous HTTP/2 requests and RST_STREAM frames over multiple streams, a remote attacker could exploit this vulnerability to cause a denial of service due to server resource consumption.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/268044 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Maximo Application Suite - Monitor Component	8.11
IBM Maximo Application Suite - Monitor Component	8.10

Remediation/Fixes

Affected Product(s)	Fixpack Version(s)
IBM Maximo Application Suite - Monitor Component	8.11.4 or latest (available from the Catalog under Update Available)
IBM Maximo Application Suite - Monitor Component	8.10.7 or latest (available from the Catalog under Update Available)

Workarounds and Mitigations

None

CPENameOperatorVersion
ibm maximo application suiteeq8.11
ibm maximo application suiteeq8.10

CPE	Name	Operator	Version
	ibm maximo application suite	eq	8.11
	ibm maximo application suite	eq	8.10