Lucene search

K
ibmIBM6DD640F2EC4EDC811946D7EE3760826CFA477E1F458CCBA202DF7D4F371FEDDC
HistoryApr 16, 2024 - 4:51 p.m.

Security Bulletin: Vulnerability in nghttp2 library (CVE-2023-44487) affects Power HMC

2024-04-1616:51:43
www.ibm.com
10
nghttp2
vulnerability
power hmc
denial of service
http/2
ibm
fix
multiplexed streams

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

High

0.732 High

EPSS

Percentile

98.1%

Summary

The nghttp2 library is used by Power Hardware Management Console (HMC). HMC has addressed the applicable CVE.

Vulnerability Details

CVEID:CVE-2023-44487
**DESCRIPTION:**Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling multiplexed streams in the HTTP/2 protocol. By sending numerous HTTP/2 requests and RST_STREAM frames over multiple streams, a remote attacker could exploit this vulnerability to cause a denial of service due to server resource consumption.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/268044 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
HMC V10.1.1010.0 V10.1.1010.0
HMC V10.2.1030.0 V10.2.1030.0
HMC V10.3.1050.0 V10.3.1050.0

Remediation/Fixes

The following fixes are available on IBM Fix Central at: <http://www-933.ibm.com/support/fixcentral/&gt;

Product

|

VRMF

|

APAR

|

Remediation/Fix

—|—|—|—

Power HMC

|

V10.1.1020.0 SP3 x86

|

MB04446

|

MF71681

Power HMC

|

V10.1.1020.0 SP3 ppc

|

MB04447

|

MF71682

Power HMC

|

V10.2.1040.0 SP2 x86

|

MB04448

|

MF71683

Power HMC

|

V10.2.1040.0 SP2 ppc

|

MB04449

|

MF71684

Power HMC

|

V10.3.1050.0 SP1 x86

|

MB04450

|

MF71685

Power HMC

|

V10.3.1050.0 SP1 ppc

|

MB04451

|

MF71686

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmhardware_management_consoleMatchany
CPENameOperatorVersion
hardware management console v10eqany

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

High

0.732 High

EPSS

Percentile

98.1%