Microsoft Response to Distributed Denial of Service (DDoS) Attacks against HTTP/2

Summary Beginning in September 2023, Microsoft was notified by industry partners about a newly identified Distributed Denial-of-Service DDoS attack technique being used in the wild targeting HTTP/2 protocol. This vulnerability CVE-2023-44487 impacts any internet exposed HTTP/2 endpoints. As an...

MITRE: CVE-2023-44487 HTTP/2 Rapid Reset Attack

...

CVE-2023-44487

creationtimestamp| type| source ---|---|--- 2023-10-10 05:00:00+00:00| seen| https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/ 2023-10-10 05:00:00+00:00| seen|...

KLA61362 Multiple vulnerabilities in Apache Tomcat

Multiple vulnerabilities were found in Apache Tomcat. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Improper Input Validation vulnerability in HTTP trailer headers...

KLA61363 Multiple vulnerabilities in Apache Tomcat

Multiple vulnerabilities were found in Apache Tomcat. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A denial of service vulnerability in HTTP/2 protocol can be...

ai.agnos:reactive-sparql_2.12 (>=0.3.0, <=0.3.1), ai.lum:odinson-rest-api_2.12 (>=0.2.0, <=0.5.0) +1256 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.12 (>=10.0.0-rc2, <=10.5.2)

com.typesafe.akka:akka-http-core2.12 MAVEN version =10.0.0-rc2, =0.3.0, =0.2.0, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.1-rc2 and more Source cves: CVE-2023-44487 Source...

CVE-2023-44487

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

cn.aradin:aradin-lucene-solr-starter (1.1.0), cn.taketoday:today-framework (>=4.0.0-draft.1, <=4.0.0-draft.3) +208 more potentially affected by CVE-2023-44487 via org.eclipse.jetty.http2:http2-common (>=11.0.0, <=11.0.16)

org.eclipse.jetty.http2:http2-common MAVEN version =11.0.0, =4.0.0-draft.1, =2.2.1, =2.2.1, =2.2.2, =2.2.1, =0.1.8, =0.20.41, =1.32.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0-beta-2, =2.8.0, =3.0.0-b9 and more Source cves: CVE-2023-44487 Source advisory: MEND:CVE-2023-44487...

KB5031362: Windows 10 Version 1607 and Windows Server 2016 Security Update (October 2023)

The remote Windows host is missing security update 5031362. It is, therefore, affected by multiple vulnerabilities - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through...

Ubuntu 22.04 LTS / 23.04 : .NET vulnerability (USN-6427-1)

The remote Ubuntu 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6427-1 advisory. It was discovered that the .NET Kestrel web server did not properly handle HTTP/2 requests. A remote attacker could possibly use this issue to cause a...

CVE-2023-44487

CVE-2023-44487 – HTTP/2 Rapid Reset DoS Root cause: HTTP/2 stream resets can cause servers to continue processing, leading to unbounded resource consumption and potential DoS when clients rapidly cancel streams. What’s affected: Various HTTP/2 implementations and deployments, including servers, p...

com.google.appengine:jetty12-assembly (2.0.20), com.hexagonkt:http_server_jetty (>=3.0.0, <=3.3.0) +6 more potentially affected by CVE-2023-44487 via org.eclipse.jetty.http2:jetty-http2-server (>=12.0.0, <=12.0.1)

org.eclipse.jetty.http2:jetty-http2-server MAVEN version =12.0.0, =3.0.0, =12.0.0, =12.0.0, =12.0.0, =12.0.1 - org.jboss.arquillian.container:arquillian-jetty-embedded-12-ee10 2.0.0.final - org.jboss.arquillian.container:arquillian-jetty-embedded-12-ee9 2.0.0.final Source cves: CVE-2023-44487...

Fixed in Apache Tomcat 9.0.81

Important: Request smuggling CVE-2023-45648 Tomcat did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. This was fixe...

app.cash.backfila:client-misk (>=0.1.4-20221221.1702-8b7db03, <=2024.05.13.200245-a6430b2), app.cash.backfila:client-misk-hibernate (>=0.1.4-20221221.1702-8b7db03, <=2024.05.13.200245-a6430b2) +216 more potentially affected by CVE-2023-44487 via org.eclipse.jetty.http2:http2-common (>=10.0.0, <=10.0.16)

org.eclipse.jetty.http2:http2-common MAVEN version =10.0.0, =0.1.4-20221221.1702-8b7db03, =0.1.4-20221221.1702-8b7db03, =2023.06.07.114626-93b9d6f, =0.1.4-20221221.1702-8b7db03, =0.1.4-20221221.1702-8b7db03, =2.9, =1.3.6, =1.6.0 - com.kmwllc:lucille-core 0.2.0 - com.kmwllc:lucille-csv-example 0.2...

FreeBSD : h2o -- HTTP/2 Rapid Reset attack vulnerability (bf545001-b96d-42e4-9d2e-60fdee204a43)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bf545001-b96d-42e4-9d2e-60fdee204a43 advisory. - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellati...

CVE-2023-44487

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

Vulnerabilities fixed in Microsoft Developer Tools

Microsoft has fixed vulnerabilities in several Developer Tools. A malicious party could exploit the vulnerabilities to cause a denial-of-service attack. Of the vulnerabilities with reference CVE-2023-44487, Microsoft has information that they are being exploited to a limited extent. HTTP/2:...

ch.qos.logback.access:logback-access-tomcat (>=2.0.4, <=2.0.6), ch.qos.logback.access:tomcat (>=2.0.0, <=2.0.3) +96 more potentially affected by CVE-2023-44487 via org.apache.tomcat:tomcat-coyote (>=10.0.0, <=10.1.13)

org.apache.tomcat:tomcat-coyote MAVEN version =10.0.0, =2.0.4, =2.0.0, =4.0.0, =3.0.0, =2.0.0.230625-alpha, =2.0.0.230625-alpha, =4.2.0, =2.3.0, =1.0.0-rc1, =0.9.15, =0.9.2, =0.9.16 and more Source cves: CVE-2023-44487 Source advisory: MEND:CVE-2023-44487...

com.addc:addc-svr-tomcat (>=2.5, <=2.9), com.cloudera.oryx:oryx-lambda-serving (>=2.3.0, <=2.5.0) +122 more potentially affected by CVE-2023-44487 via org.apache.tomcat:tomcat-coyote (>=8.5.0, <=8.5.93)

org.apache.tomcat:tomcat-coyote MAVEN version =8.5.0, =2.5, =2.3.0, =1.0.0, =1.6.1, =1.0.0, =1.0.4, =3.0.0.rc2, =3.0.0.rc2, =1.8.2, =2.1, =1.0.0, =0.0.4, =0.1.0 and more Source cves: CVE-2023-44487 Source advisory: MEND:CVE-2023-44487...

ai.mantik:bridge-protocol_2.13 (>=0.4.0-rc1, <=0.4.0), ai.mantik:componently_2.13 (>=0.4.0-rc1, <=0.4.0) +1041 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.13 (>=10.1.8, <=10.5.2)

com.typesafe.akka:akka-http-core2.13 MAVEN version =10.1.8, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0 and more Source cves: CVE-2023-44487 Source...