PT-2024-2570

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions prior to 11.0.0-M1, 10.1.0-M1, 9.0.0-M1, 8.5.0 through 8.5.98. Description The vulnerability in Apache Tomcat is due to improper input validation for HTTP/2 requests, leading to potential DoS conditions. If the request...

Important: amazon-ssm-agent

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 A malicious HTTP sender can use chunk extensions to cause a receiver...

Important: amazon-ssm-agent

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 A malicious HTTP sender can use chunk extensions to cause a receiver...

Fixed in Apache Tomcat 11.0.0-M17

Important: Denial of Service CVE-2024-23672 It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption. This was fixed with commit b0e3b1bd. This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made publi...

Fixed in Apache Tomcat 9.0.86

Important: Denial of Service CVE-2024-23672 It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption. This was fixed with commit 52d6650e. This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made publi...

Fixed in Apache Tomcat 10.1.19

Important: Denial of Service CVE-2024-23672 It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption. This was fixed with commit 0052b374. This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made publi...

Amazon Linux AMI : amazon-ssm-agent (ALAS-2024-1920)

The version of amazon-ssm-agent installed on the remote host is prior to 3.2.2222.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2024-1920 advisory. 2024-04-25: CVE-2023-49568 was added to this advisory. 2024-02-28: CVE-2023-39325 was added to this advisory...

Security Bulletin: IBM Match 360 is vulnerable to vulnerable to a denial of service due to HTTP/2 Rapid Reset within IBM WebSphere Application Server Liberty (CVE-2023-44487)

Summary IBM Match 360 is vulnerable to vulnerable to a denial of service due to HTTP/2 Rapid Reset within IBM WebSphere Application Server Liberty. Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling multiplexed streams in the HTTP/2 protocol. By sending numerous...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty may affect IBM Storage Scale (CVE-2023-46158, CVE-2023-44487)

Summary There are vulnerabilities in IBM WebSphere Application Server Liberty, used by IBM Storage Scale, which could provide weaker than expected security due to improper resource expiration handling. Vulnerability Details CVEID:CVE-2023-46158 DESCRIPTION: IBM WebSphere Application Server Libert...

PT-2024-2655 · Libcurl +12 · Libcurl +12

Name of the Vulnerable Software and Affected Versions: libcurl affected versions not specified Description: The issue is related to a memory leak in libcurl when handling HTTP/2 server push. When the amount of received headers for the push surpasses the maximum allowed limit 1000, libcurl aborts...

CVE-2024-23314

When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

Code injection

When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-23314 BIG-IP HTTP/2 vulnerability

When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-23314

CVE-2024-23314 affects BIG-IP and BIG-IP Next SPK when HTTP/2 is configured. Undisclosed responses can cause TMM to terminate, leading to DoS on the data plane. Remediations per F5 advisory K000137675: BIG-IP fixed in 17.1.1 (all modules); BIG-IP Next SPK fixed in 1.8.1. Confirm your branch/versi...

CVE-2024-23314 BIG-IP HTTP/2 vulnerability

When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

K000137675: BIG-IP HTTP/2 vulnerability CVE-2024-23314

Security Advisory Description When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel TMM to terminate. CVE-2024-23314 Impact Traffic is disrupted while the TMM process restarts. This vulnerability allows a remote...

F5 Networks BIG-IP : BIG-IP HTTP/2 vulnerability (K000137675)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 16.1.4 / 17.1.1. It is, therefore, affected by a vulnerability as referenced in the K000137675 advisory. - When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffi...

Huawei EulerOS: Security Advisory for nginx (EulerOS-SA-2024-1154)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS 8 : rhc (CESA-2023:7058)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:7058 advisory. - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of...

Fortinet Fortigate CVE-2023-44487 - Rapid Reset HTTP/2 vulnerability (FG-IR-23-397)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-397 advisory. - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many...