18 Star 0 Fork 3

src-openEuler/jetty8

 / 详情

CVE-2023-44487

待办的
CVE和安全问题 拥有者
创建于  
2024-12-25 12:10

一、漏洞信息
漏洞编号:CVE-2023-44487
漏洞归属组件:jetty8
漏洞归属的版本:8.1.17
CVSS V3.0分值:
BaseScore:7.5 High
Vector:CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞简述:
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
漏洞公开时间:2023-10-10 22:15:10
漏洞创建时间:2024-12-25 12:10:18
漏洞详情参考链接:
https://nvd.nist.gov/vuln/detail/CVE-2023-44487

更多参考(点击展开)
参考来源 参考链接 来源链接
cve.mitre.org http://www.openwall.com/lists/oss-security/2023/10/10/6
cve.mitre.org http://www.openwall.com/lists/oss-security/2023/10/10/7
cve.mitre.org http://www.openwall.com/lists/oss-security/2023/10/13/4
cve.mitre.org http://www.openwall.com/lists/oss-security/2023/10/13/9
cve.mitre.org http://www.openwall.com/lists/oss-security/2023/10/18/4
cve.mitre.org http://www.openwall.com/lists/oss-security/2023/10/18/8
cve.mitre.org http://www.openwall.com/lists/oss-security/2023/10/19/6
cve.mitre.org http://www.openwall.com/lists/oss-security/2023/10/20/8
cve.mitre.org https://access.redhat.com/security/cve/cve-2023-44487
cve.mitre.org https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/
cve.mitre.org https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
cve.mitre.org https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
cve.mitre.org https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
cve.mitre.org https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/
cve.mitre.org https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack
cve.mitre.org https://blog.vespa.ai/cve-2023-44487/
cve.mitre.org https://bugzilla.proxmox.com/show_bug.cgi?id=4988
cve.mitre.org https://bugzilla.redhat.com/show_bug.cgi?id=2242803
cve.mitre.org https://bugzilla.suse.com/show_bug.cgi?id=1216123
cve.mitre.org https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9
cve.mitre.org https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/
cve.mitre.org https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
cve.mitre.org https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125
cve.mitre.org https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715
cve.mitre.org https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve
cve.mitre.org https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
cve.mitre.org https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088
cve.mitre.org https://github.com/Azure/AKS/issues/3947
cve.mitre.org https://github.com/Kong/kong/discussions/11741
cve.mitre.org https://github.com/advisories/GHSA-qppj-fm5r-hxr3
cve.mitre.org https://github.com/advisories/GHSA-vx74-f528-fxqg
cve.mitre.org https://github.com/advisories/GHSA-xpw8-rcwv-8f8p
cve.mitre.org https://github.com/akka/akka-http/issues/4323
cve.mitre.org https://github.com/alibaba/tengine/issues/1872
cve.mitre.org https://github.com/apache/apisix/issues/10320
cve.mitre.org https://github.com/apache/httpd-site/pull/10
cve.mitre.org https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113
cve.mitre.org https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2
cve.mitre.org https://github.com/apache/trafficserver/pull/10564
cve.mitre.org https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487
cve.mitre.org https://github.com/bcdannyboy/CVE-2023-44487
cve.mitre.org https://github.com/caddyserver/caddy/issues/5877
cve.mitre.org https://github.com/caddyserver/caddy/releases/tag/v2.7.5
cve.mitre.org https://github.com/dotnet/announcements/issues/277
cve.mitre.org https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73
cve.mitre.org https://github.com/eclipse/jetty.project/issues/10679
cve.mitre.org https://github.com/envoyproxy/envoy/pull/30055
cve.mitre.org https://github.com/etcd-io/etcd/issues/16740
cve.mitre.org https://github.com/facebook/proxygen/pull/466
cve.mitre.org https://github.com/golang/go/issues/63417
cve.mitre.org https://github.com/grpc/grpc-go/pull/6703
cve.mitre.org https://github.com/grpc/grpc/releases/tag/v1.59.2
cve.mitre.org https://github.com/h2o/h2o/pull/3291
cve.mitre.org https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf
cve.mitre.org https://github.com/haproxy/haproxy/issues/2312
cve.mitre.org https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244
cve.mitre.org https://github.com/junkurihara/rust-rpxy/issues/97
cve.mitre.org https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1
cve.mitre.org https://github.com/kazu-yamamoto/http2/issues/93
cve.mitre.org https://github.com/kubernetes/kubernetes/pull/121120
cve.mitre.org https://github.com/line/armeria/pull/5232
cve.mitre.org https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632
cve.mitre.org https://github.com/micrictor/http2-rst-stream
cve.mitre.org https://github.com/microsoft/CBL-Mariner/pull/6381
cve.mitre.org https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
cve.mitre.org https://github.com/nghttp2/nghttp2/pull/1961
cve.mitre.org https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
cve.mitre.org https://github.com/ninenines/cowboy/issues/1615
cve.mitre.org https://github.com/nodejs/node/pull/50121
cve.mitre.org https://github.com/openresty/openresty/issues/930
cve.mitre.org https://github.com/opensearch-project/data-prepper/issues/3474
cve.mitre.org https://github.com/oqtane/oqtane.framework/discussions/3367
cve.mitre.org https://github.com/projectcontour/contour/pull/5826
cve.mitre.org https://github.com/tempesta-tech/tempesta/issues/1986
cve.mitre.org https://github.com/varnishcache/varnish-cache/issues/3996
cve.mitre.org https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
cve.mitre.org https://istio.io/latest/news/security/istio-security-2023-004/
cve.mitre.org https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/
cve.mitre.org https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q
cve.mitre.org https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
cve.mitre.org https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html
cve.mitre.org https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html
cve.mitre.org https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html
cve.mitre.org https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html
cve.mitre.org https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html
cve.mitre.org https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/

漏洞分析指导链接:
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
其它
漏洞补丁信息:

详情(点击展开)
影响的包 修复版本 修复补丁 问题引入补丁 来源
https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 cve.mitre.org
https://github.com/apache/httpd-site/pull/10 cve.mitre.org
https://github.com/apache/trafficserver/pull/10564 cve.mitre.org
https://github.com/envoyproxy/envoy/pull/30055 cve.mitre.org
https://github.com/facebook/proxygen/pull/466 cve.mitre.org
https://github.com/grpc/grpc-go/pull/6703 cve.mitre.org
https://github.com/h2o/h2o/pull/3291 cve.mitre.org
https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1 cve.mitre.org
https://github.com/kubernetes/kubernetes/pull/121120 cve.mitre.org
https://github.com/line/armeria/pull/5232 cve.mitre.org
https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632 cve.mitre.org
https://github.com/microsoft/CBL-Mariner/pull/6381 cve.mitre.org
https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 cve.mitre.org
https://github.com/nghttp2/nghttp2/pull/1961 cve.mitre.org
https://github.com/nodejs/node/pull/50121 cve.mitre.org
https://github.com/projectcontour/contour/pull/5826 cve.mitre.org
https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 af854a3a-2127-422b-91ae-364da2661108
https://github.com/apache/httpd-site/pull/10 af854a3a-2127-422b-91ae-364da2661108
https://github.com/apache/trafficserver/pull/10564 af854a3a-2127-422b-91ae-364da2661108
https://github.com/envoyproxy/envoy/pull/30055 af854a3a-2127-422b-91ae-364da2661108
https://github.com/facebook/proxygen/pull/466 af854a3a-2127-422b-91ae-364da2661108
https://github.com/grpc/grpc-go/pull/6703 af854a3a-2127-422b-91ae-364da2661108
https://github.com/h2o/h2o/pull/3291 af854a3a-2127-422b-91ae-364da2661108
https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1 af854a3a-2127-422b-91ae-364da2661108
https://github.com/kubernetes/kubernetes/pull/121120 af854a3a-2127-422b-91ae-364da2661108
https://github.com/line/armeria/pull/5232 af854a3a-2127-422b-91ae-364da2661108
https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632 af854a3a-2127-422b-91ae-364da2661108
https://github.com/microsoft/CBL-Mariner/pull/6381 af854a3a-2127-422b-91ae-364da2661108
https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 af854a3a-2127-422b-91ae-364da2661108
https://github.com/nghttp2/nghttp2/pull/1961 af854a3a-2127-422b-91ae-364da2661108
https://github.com/nodejs/node/pull/50121 af854a3a-2127-422b-91ae-364da2661108
https://github.com/projectcontour/contour/pull/5826 af854a3a-2127-422b-91ae-364da2661108
https://github.com/apache/trafficserver/pull/10564 github_advisory
https://github.com/nodejs/node/pull/50121 github_advisory
https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 github_advisory
https://github.com/h2o/h2o/pull/3291 github_advisory
https://github.com/nghttp2/nghttp2/pull/1961 github_advisory
https://github.com/grpc/grpc-go/pull/6703 github_advisory
https://github.com/facebook/proxygen/pull/466 github_advisory
https://github.com/microsoft/CBL-Mariner/pull/6381 github_advisory
https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 github_advisory
https://github.com/envoyproxy/envoy/pull/30055 github_advisory
https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832 nghttp2
https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 osv
https://github.com/nghttp2/nghttp2/pull/1961 osv
https://github.com/envoyproxy/envoy/pull/30055 osv
https://github.com/grpc/grpc-go/pull/6703 osv
https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 osv
https://github.com/apache/trafficserver/pull/10564 osv
https://github.com/facebook/proxygen/pull/466 osv
https://github.com/microsoft/CBL-Mariner/pull/6381 osv
https://github.com/nodejs/node/pull/50121 osv
https://github.com/h2o/h2o/pull/3291 osv
https://github.com/kubernetes/kubernetes/pull/121120 osv
https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1 osv
https://github.com/apache/tomcat/commit/76bb4bfbfeae827dce896f650655bbf6e251ed49 snyk
https://github.com/apache/tomcat/commit/9cdfe25bad707f34b3e5da2994f3f1952a163c3e snyk
https://github.com/eclipse/jetty.project/commit/dbb94514dc9d3fb21fe92080f57c314e7e06a148 snyk
https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 snyk
https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832 snyk
https://github.com/helidon-io/helidon/commit/58f43670086e530750c7cb74b0bec92bf5189c79 snyk
https://github.com/gravitational/teleport/commit/15f34f927a45130408eb16ed09af5620270d4d1f snyk
https://github.com/kubernetes/apimachinery/commit/be9188050914374ee8128239e5a2e5998d7897f5 snyk
https://github.com/operator-framework/operator-lifecycle-manager/commit/9ec03f07f942dc9cef736957fa152e39157d6e13 snyk
https://github.com/pgjones/hypercorn/commit/7c39c68b61012a3c30979176080861c8b00fb229 snyk
https://github.com/akka/akka-http/commit/1f29fe6a8567c57dfe848a21ae883304cce5646d snyk
http://www.openwall.com/lists/oss-security/2023/10/10/6 nvd
http://www.openwall.com/lists/oss-security/2023/10/10/7 nvd
http://www.openwall.com/lists/oss-security/2023/10/13/4 nvd
http://www.openwall.com/lists/oss-security/2023/10/13/9 nvd
http://www.openwall.com/lists/oss-security/2023/10/18/4 nvd
http://www.openwall.com/lists/oss-security/2023/10/18/8 nvd
http://www.openwall.com/lists/oss-security/2023/10/19/6 nvd
http://www.openwall.com/lists/oss-security/2023/10/20/8 nvd
https://access.redhat.com/security/cve/cve-2023-44487 nvd
https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/ nvd
https://aws.amazon.com/security/security-bulletins/AWS-2023-011/ nvd
https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ nvd
https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/ nvd
https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/ nvd
https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack nvd
https://blog.vespa.ai/cve-2023-44487/ nvd
https://bugzilla.proxmox.com/show_bug.cgi?id=4988 nvd
https://bugzilla.redhat.com/show_bug.cgi?id=2242803 nvd
https://bugzilla.suse.com/show_bug.cgi?id=1216123 nvd
https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 nvd
https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/ nvd
https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack nvd
https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125 nvd
https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715 nvd
https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve nvd
https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764 nvd
https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088 nvd
https://github.com/Azure/AKS/issues/3947 nvd
https://github.com/Kong/kong/discussions/11741 nvd
https://github.com/advisories/GHSA-qppj-fm5r-hxr3 nvd
https://github.com/advisories/GHSA-vx74-f528-fxqg nvd
https://github.com/advisories/GHSA-xpw8-rcwv-8f8p nvd
https://github.com/akka/akka-http/issues/4323 nvd
https://github.com/alibaba/tengine/issues/1872 nvd

二、漏洞分析结构反馈
影响性分析说明:

openEuler评分:

受影响版本排查(受影响/不受影响):
1.master(8.1.17):
2.openEuler-20.03-LTS-SP4:
3.openEuler-22.03-LTS-SP1:
4.openEuler-22.03-LTS-SP3:
5.openEuler-22.03-LTS-SP4:
6.openEuler-24.03-LTS:
7.openEuler-24.03-LTS-Next:
8.openEuler-24.03-LTS-SP1:

修复是否涉及abi变化(是/否):
1.master(8.1.17):
2.openEuler-20.03-LTS-SP4:
3.openEuler-22.03-LTS-SP1:
4.openEuler-22.03-LTS-SP3:
5.openEuler-22.03-LTS-SP4:
6.openEuler-24.03-LTS:
7.openEuler-24.03-LTS-Next:
8.openEuler-24.03-LTS-SP1:

原因说明:
1.master(8.1.17):
2.openEuler-20.03-LTS-SP4:
3.openEuler-22.03-LTS-SP1:
4.openEuler-22.03-LTS-SP3:
5.openEuler-22.03-LTS-SP4:
6.openEuler-24.03-LTS:
7.openEuler-24.03-LTS-Next:
8.openEuler-24.03-LTS-SP1:

评论 (2)

openeuler-ci-bot 创建了CVE和安全问题 4个月前
openeuler-ci-bot 添加了
 
CVE/UNFIXED
标签
4个月前
展开全部操作日志
openeuler-ci-bot 添加了
 
sig/sig-recycle
标签
4个月前
openeuler-ci-bot 计划开始日期设置为2024-12-25 4个月前
openeuler-ci-bot 计划截止日期设置为2025-01-24 4个月前
openeuler-ci-bot 优先级设置为主要 4个月前
openeuler-ci-bot 修改了描述 3个月前
openeuler-ci-bot 修改了描述 2个月前
openeuler-ci-bot 修改了描述 1个月前
openeuler-ci-bot 修改了描述 10天前

登录 后才可以发表评论

状态
负责人
项目
Pull Requests
关联的 Pull Requests 被合并后可能会关闭此 issue
预计工期 (小时)
开始日期   -   截止日期
-
置顶选项
优先级
里程碑
分支
参与者(1)
5329419 openeuler ci bot 1632792936
1
https://gitee.com/src-openeuler/jetty8.git
git@gitee.com:src-openeuler/jetty8.git
src-openeuler
jetty8
jetty8

搜索帮助