CVE-2023-44487

一、漏洞信息
 漏洞编号：[CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487)
 漏洞归属组件：[nghttp2](https://gitee.com/src-openeuler/nghttp2)
 漏洞归属的版本：1.41.0,1.42.0,1.43.0,1.45.1,1.46.0,1.47.0,1.52.0,1.55.1
 CVSS V3.0分值：
  BaseScore：7.5 High
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
 漏洞公开时间：2023-10-10 14:15:10
 漏洞创建时间：2023-10-19 01:11:22
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-44487
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cve.mitre.org | http://www.openwall.com/lists/oss-security/2023/10/13/4 |  |
| cve.mitre.org | http://www.openwall.com/lists/oss-security/2023/10/13/9 |  |
| cve.mitre.org | http://www.openwall.com/lists/oss-security/2023/10/18/4 |  |
| cve.mitre.org | http://www.openwall.com/lists/oss-security/2023/10/18/8 |  |
| cve.mitre.org | http://www.openwall.com/lists/oss-security/2023/10/19/6 |  |
| cve.mitre.org | http://www.openwall.com/lists/oss-security/2023/10/20/8 |  |
| cve.mitre.org | https://access.redhat.com/security/cve/cve-2023-44487 |  |
| cve.mitre.org | https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/ |  |
| cve.mitre.org | https://aws.amazon.com/security/security-bulletins/AWS-2023-011/ |  |
| cve.mitre.org | https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ |  |
| cve.mitre.org | https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/ |  |
| cve.mitre.org | https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/ |  |
| cve.mitre.org | https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack |  |
| cve.mitre.org | https://blog.vespa.ai/cve-2023-44487/ |  |
| cve.mitre.org | https://bugzilla.proxmox.com/show_bug.cgi?id=4988 |  |
| cve.mitre.org | https://bugzilla.redhat.com/show_bug.cgi?id=2242803 |  |
| cve.mitre.org | https://bugzilla.suse.com/show_bug.cgi?id=1216123 |  |
| cve.mitre.org | https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 |  |
| cve.mitre.org | https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/ |  |
| cve.mitre.org | https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack |  |
| cve.mitre.org | https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125 |  |
| cve.mitre.org | https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve |  |
| cve.mitre.org | https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764 |  |
| cve.mitre.org | https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088 |  |
| cve.mitre.org | https://github.com/Azure/AKS/issues/3947 |  |
| cve.mitre.org | https://github.com/Kong/kong/discussions/11741 |  |
| cve.mitre.org | https://github.com/advisories/GHSA-qppj-fm5r-hxr3 |  |
| cve.mitre.org | https://github.com/advisories/GHSA-vx74-f528-fxqg |  |
| cve.mitre.org | https://github.com/advisories/GHSA-xpw8-rcwv-8f8p |  |
| cve.mitre.org | https://github.com/akka/akka-http/issues/4323 |  |
| cve.mitre.org | https://github.com/alibaba/tengine/issues/1872 |  |
| cve.mitre.org | https://github.com/apache/apisix/issues/10320 |  |
| cve.mitre.org | https://github.com/apache/httpd-site/pull/10 |  |
| cve.mitre.org | https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113 |  |
| cve.mitre.org | https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2 |  |
| cve.mitre.org | https://github.com/apache/trafficserver/pull/10564 |  |
| cve.mitre.org | https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487 |  |
| cve.mitre.org | https://github.com/bcdannyboy/CVE-2023-44487 |  |
| cve.mitre.org | https://github.com/caddyserver/caddy/issues/5877 |  |
| cve.mitre.org | https://github.com/caddyserver/caddy/releases/tag/v2.7.5 |  |
| cve.mitre.org | https://github.com/dotnet/announcements/issues/277 |  |
| cve.mitre.org | https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73 |  |
| cve.mitre.org | https://github.com/eclipse/jetty.project/issues/10679 |  |
| cve.mitre.org | https://github.com/envoyproxy/envoy/pull/30055 |  |
| cve.mitre.org | https://github.com/etcd-io/etcd/issues/16740 |  |
| cve.mitre.org | https://github.com/facebook/proxygen/pull/466 |  |
| cve.mitre.org | https://github.com/golang/go/issues/63417 |  |
| cve.mitre.org | https://github.com/grpc/grpc-go/pull/6703 |  |
| cve.mitre.org | https://github.com/h2o/h2o/pull/3291 |  |
| cve.mitre.org | https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf |  |
| cve.mitre.org | https://github.com/haproxy/haproxy/issues/2312 |  |
| cve.mitre.org | https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244 |  |
| cve.mitre.org | https://github.com/junkurihara/rust-rpxy/issues/97 |  |
| cve.mitre.org | https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1 |  |
| cve.mitre.org | https://github.com/kazu-yamamoto/http2/issues/93 |  |
| cve.mitre.org | https://github.com/kubernetes/kubernetes/pull/121120 |  |
| cve.mitre.org | https://github.com/line/armeria/pull/5232 |  |
| cve.mitre.org | https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632 |  |
| cve.mitre.org | https://github.com/micrictor/http2-rst-stream |  |
| cve.mitre.org | https://github.com/microsoft/CBL-Mariner/pull/6381 |  |
| cve.mitre.org | https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 |  |
| cve.mitre.org | https://github.com/nghttp2/nghttp2/pull/1961 |  |
| cve.mitre.org | https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0 |  |
| cve.mitre.org | https://github.com/ninenines/cowboy/issues/1615 |  |
| cve.mitre.org | https://github.com/nodejs/node/pull/50121 |  |
| cve.mitre.org | https://github.com/openresty/openresty/issues/930 |  |
| cve.mitre.org | https://github.com/opensearch-project/data-prepper/issues/3474 |  |
| cve.mitre.org | https://github.com/oqtane/oqtane.framework/discussions/3367 |  |
| cve.mitre.org | https://github.com/projectcontour/contour/pull/5826 |  |
| cve.mitre.org | https://github.com/tempesta-tech/tempesta/issues/1986 |  |
| cve.mitre.org | https://github.com/varnishcache/varnish-cache/issues/3996 |  |
| cve.mitre.org | https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo |  |
| cve.mitre.org | https://istio.io/latest/news/security/istio-security-2023-004/ |  |
| cve.mitre.org | https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/ |  |
| cve.mitre.org | https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q |  |
| cve.mitre.org | https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html |  |
| cve.mitre.org | https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html |  |
| cve.mitre.org | https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/ |  |
| cve.mitre.org | https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html |  |
| cve.mitre.org | https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html |  |
| cve.mitre.org | https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html |  |
| cve.mitre.org | https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/ |  |
| cve.mitre.org | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487 |  |
| cve.mitre.org | https://my.f5.com/manage/s/article/K000137106 |  |
| cve.mitre.org | https://netty.io/news/2023/10/10/4-1-100-Final.html |  |
| cve.mitre.org | https://news.ycombinator.com/item?id=37830987 |  |
| cve.mitre.org | https://news.ycombinator.com/item?id=37830998 |  |
| cve.mitre.org | https://news.ycombinator.com/item?id=37831062 |  |
| cve.mitre.org | https://news.ycombinator.com/item?id=37837043 |  |
| cve.mitre.org | https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/ |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 |  | cve.mitre.org |
|  |  | https://github.com/apache/httpd-site/pull/10 |  | cve.mitre.org |
|  |  | https://github.com/apache/trafficserver/pull/10564 |  | cve.mitre.org |
|  |  | https://github.com/envoyproxy/envoy/pull/30055 |  | cve.mitre.org |
|  |  | https://github.com/facebook/proxygen/pull/466 |  | cve.mitre.org |
|  |  | https://github.com/grpc/grpc-go/pull/6703 |  | cve.mitre.org |
|  |  | https://github.com/h2o/h2o/pull/3291 |  | cve.mitre.org |
|  |  | https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1 |  | cve.mitre.org |
|  |  | https://github.com/kubernetes/kubernetes/pull/121120 |  | cve.mitre.org |
|  |  | https://github.com/line/armeria/pull/5232 |  | cve.mitre.org |
|  |  | https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632 |  | cve.mitre.org |
|  |  | https://github.com/microsoft/CBL-Mariner/pull/6381 |  | cve.mitre.org |
|  |  | https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 |  | cve.mitre.org |
|  |  | https://github.com/nghttp2/nghttp2/pull/1961 |  | cve.mitre.org |
|  |  | https://github.com/nodejs/node/pull/50121 |  | cve.mitre.org |
|  |  | https://github.com/projectcontour/contour/pull/5826 |  | cve.mitre.org |
|  |  | https://github.com/apache/trafficserver/pull/10564 |  | github_advisory |
|  |  | https://github.com/nodejs/node/pull/50121 |  | github_advisory |
|  |  | https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 |  | github_advisory |
|  |  | https://github.com/h2o/h2o/pull/3291 |  | github_advisory |
|  |  | https://github.com/nghttp2/nghttp2/pull/1961 |  | github_advisory |
|  |  | https://github.com/grpc/grpc-go/pull/6703 |  | github_advisory |
|  |  | https://github.com/facebook/proxygen/pull/466 |  | github_advisory |
|  |  | https://github.com/microsoft/CBL-Mariner/pull/6381 |  | github_advisory |
|  |  | https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 |  | github_advisory |
|  |  | https://github.com/envoyproxy/envoy/pull/30055 |  | github_advisory |
|  |  | https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832 |  | nghttp2 |
|  |  | https://github.com/apache/tomcat/commit/76bb4bfbfeae827dce896f650655bbf6e251ed49 |  | snyk |
|  |  | https://github.com/apache/tomcat/commit/9cdfe25bad707f34b3e5da2994f3f1952a163c3e |  | snyk |
|  |  | https://github.com/eclipse/jetty.project/commit/dbb94514dc9d3fb21fe92080f57c314e7e06a148 |  | snyk |
|  |  | https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 |  | snyk |
|  |  | https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832 |  | snyk |
| tomcat |  | https://github.com/apache/tomcat/commit/944332bb15bd2f3bf76ec2caeb1ff0a58a3bc628 |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/6d1a9fd6642387969e4410b9989c85856b74917a |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/76bb4bfbfeae827dce896f650655bbf6e251ed49 |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/9cdfe25bad707f34b3e5da2994f3f1952a163c3e |  | tomcat |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    HTTP/2协议允许客户端通过发送RST_STREAM帧来指示服务器应该取消之前的流。该协议允许客户端单方面请求取消，这种攻击被称为快速重置。在HTTP/2快速重置攻击中，客户端一次打开大量流，但不等待服务器或代理对每个请求流的响应，而是立即取消每个请求，通过大规模利用请求-取消-请求-取消快速重置攻击，会导致服务器CPU资源快速消耗，达到系统拒绝服务。 
 openEuler评分：
  7.5
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(1.41.0):受影响
2.openEuler-20.03-LTS-SP3(1.41.0):受影响
3.openEuler-20.03-LTS-SP4:受影响
4.openEuler-22.03-LTS(1.46.0):受影响
5.openEuler-22.03-LTS-SP1:受影响
6.openEuler-22.03-LTS-SP2:受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(1.41.0):否
2.openEuler-20.03-LTS-SP3(1.41.0):否
3.openEuler-20.03-LTS-SP4:否
4.openEuler-22.03-LTS(1.46.0):否
5.openEuler-22.03-LTS-SP1:否
6.openEuler-22.03-LTS-SP2:否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2023-1771

src-openEuler/nghttp2
关闭

内容风险标识

评论 (16)

src-openEuler/nghttp2关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-44487

评论 (16)

搜索帮助

src-openEuler/nghttp2
关闭