858 matches found
[slackware-security] nghttp2
New nghttp2 packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/nghttp2-1.57.0-i586-1slack15.0.txz: Upgraded. This release has a fix to mitigate the HTTP/2 Rapid Reset vulnerability. For more...
Exploit for Uncontrolled Resource Consumption in Ietf Http
This is a proof of concept for a Denial of Service DoS exploit...
Debian DSA-5521-1 : tomcat10 - security update
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5521 advisory. - The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP...
Debian: Security Advisory (DSA-5521-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Apache Tomcat Multiple Vulnerabilities (Oct 2023) - Linux
Apache Tomcat is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"; if descriptio...
Security Update for .NET Core SDK (October 2023)
The version of Microsoft .NET Core SDK installed on the remote host is 6.0.x prior to 6.0.123, 6.0.x prior to 6.0.318, 6.0.x prior to 6.0.414, 7.0.x prior to 7.0.112 or 7.0.x prior to 7.0.309 or 7.0.x prior to 7.0.402. It is, therefore, affected by multiple vulnerabilities, as follows: - A...
Slackware Linux 15.0 / current nghttp2 Vulnerability (SSA:2023-284-02)
The version of nghttp2 installed on the remote host is prior to 1.57.0. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-284-02 advisory. - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...
Patch Tuesday, October 2023 Edition
Microsoft today issued security updates for more than 100 newly-discovered vulnerabilities in its Windows operating system and related software, including four flaws that are already being exploited. In addition, Apple recently released emergency updates to quash a pair of zero-day bugs in iOS...
com.ericsson.research.trap.transports:wshttp-server-netty (=1.4.2), com.github.kristofa:brave-grpc (>=3.6.0 <=3.7.0) +95 more potentially affected by CVE-2023-44487 via io.netty:netty-codec-http2 (>=4.1.0.Beta4 <=4.1.0.Final)
io.netty:netty-codec-http2 MAVEN version =4.1.0.Beta4, =3.6.0, =0.0.0, =0.0.0, =0.0.0, =0.0.0, =0.0.1, =0.2.0, =1.0.0, =1.0.0, =1.3.0, =1.9.1 and more Source cves: CVE-2023-44487 Source advisory: OSV:GHSA-XPW8-RCWV-8F8P...
[SECURITY] [DSA 5522-1] tomcat9 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5522-1 [email protected] https://www.debian.org/security/ Markus Koschany October 10, 2023 https://www.debian.org/security/faq -...
[SECURITY] [DSA 5521-1] tomcat10 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5521-1 [email protected] https://www.debian.org/security/ Markus Koschany October 10, 2023 https://www.debian.org/security/faq -...
CVE-2023-44487 HTTP/2 Rapid Reset Attack
Today, Amazon Web Services, Cloudflare, and Google, in a coordinated announcement, reveal their experiences mitigating powerful HTTP/2-based DDoS attacks utilizing a zero-day technique referred to as Rapid Reset, documented under the vulnerability identifier CVE-2023-44487. The attack magnitudes...
ai.agnos:reactive-sparql_2.12 (>=0.3.0 <=0.3.1), ai.lum:odinson-rest-api_2.12 (>=0.2.0 <=0.5.0) +1253 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.12 (>=10.0.0-RC2 <=10.5.2)
com.typesafe.akka:akka-http-core2.12 MAVEN version =10.0.0-RC2, =0.3.0, =0.2.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.1-rc2 and more Source cves: CVE-2023-44487 Source advisory: OSV:GHSA-QPPJ-FM5R-HXR3...
com.atlan:package-toolkit-testing (>=5.3.1 <=6.1.2), com.buschmais.jqassistant.cli:jqassistant-commandline-neo4jv5 (>=2.6.0 <=2.8.0) +827 more potentially affected by CVE-2023-44487 via org.eclipse.jetty.http2:jetty-http2-common (>=12.0.0 <=12.0.19)
org.eclipse.jetty.http2:jetty-http2-common MAVEN version =12.0.0, =5.3.1, =2.6.0, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.223 and more Source cves: CVE-2023-44487 Source advisory: OSV:GHSA-QPPJ-FM5R-HXR3...
ai.mantik:bridge-protocol_2.13 (>=0.4.0 <=0.4.0-rc1), ai.mantik:componently_2.13 (>=0.4.0 <=0.4.0-rc1) +858 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.13 (>=10.1.8 <=10.5.2)
com.typesafe.akka:akka-http-core2.13 MAVEN version =10.1.8, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0-rc1 and more Source cves: CVE-2023-44487 Source advisory: OSV:GHSA-QPPJ-FM5R-HXR3...
github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset
Impact Rapidly creating and cancelling streams HEADERS frame immediately followed by RSTSTREAM without bound cause denial of service. See https://vulners.com/cve/CVE-2023-44487 for details. Patches nghttp2 v1.57.0 mitigates this vulnerability by default. Workarounds If upgrading to nghttp2 v1.57....
GHSA-VX74-F528-FXQG github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset
Impact Rapidly creating and cancelling streams HEADERS frame immediately followed by RSTSTREAM without bound cause denial of service. See https://vulners.com/cve/CVE-2023-44487 for details. Patches nghttp2 v1.57.0 mitigates this vulnerability by default. Workarounds If upgrading to nghttp2 v1.57....
HTTP/2 Rapid Reset Zero-Day Vulnerability Exploited to Launch Record DDoS Attacks
Amazon Web Services AWS, Cloudflare, and Google on Tuesday said they took steps to mitigate record-breaking distributed denial-of-service DDoS attacks that relied on a novel technique called HTTP/2 Rapid Reset. The layer 7 attacks were detected in late August 2023, the companies said in a...
AZL-39603 CVE-2023-44487 affecting package cri-o for versions less than 1.21.7-2
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-31325 CVE-2023-44487 affecting package moby-buildx for versions less than 0.7.1-14
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...