access.redhat.com Open in urlscan Pro
2a02:26f0:1700:11::b856:678d Public Scan

Back to summary

URL:
https://access.redhat.com/security/cve/CVE-2023-44487
Submission: On October 24 via api (October 24th 2023, 7:22:20 am UTC) from IN — Scanned from DE

Form analysis
1 forms found in the DOM

Name: topSearchForm — GET /search/browse/search/

<form class="ng-pristine ng-valid topSearchForm" id="topSearchForm" name="topSearchForm" action="/search/browse/search/" method="get" enctype="application/x-www-form-urlencoded">
  <cp-search-autocomplete class="push-bottom" path="/webassets/avalon/j/data.json" pfelement="" type="container"></cp-search-autocomplete>
  <div> Or <a href="/support/cases/#/troubleshoot">troubleshoot an issue</a>. </div>
</form>

Text Content

Skip to navigation Skip to main content

UTILITIES

* Subscriptions
* Downloads
* Containers
* Support Cases

* Subscriptions
* Downloads
* Containers
* Support Cases
* Products & Services

PRODUCTS

SUPPORT

* Production Support
* Development Support
* Product Life Cycles

SERVICES

* Consulting
* Technical Account Management
* Training & Certifications

DOCUMENTATION

* Red Hat Enterprise Linux
* Red Hat JBoss Enterprise Application Platform
* Red Hat OpenStack Platform
* Red Hat OpenShift Container Platform

All Documentation

ECOSYSTEM CATALOG

* Red Hat Partner Ecosystem
* Partner Resources

* Tools

TOOLS

* Troubleshoot a product issue
* Packages
* Errata

CUSTOMER PORTAL LABS

* Configuration
* Deployment
* Security
* Troubleshoot

All labs

RED HAT INSIGHTS

Increase visibility into IT operations to detect and resolve technical issues
before they impact your business.

Learn More
Go to Insights
* Security

RED HAT PRODUCT SECURITY CENTER

Engage with our Red Hat Product Security team, access security updates, and
ensure your environments are not exposed to any known security
vulnerabilities.

Product Security Center

SECURITY UPDATES

* Security Advisories
* Red Hat CVE Database
* Security Labs

Keep your systems secure with Red Hat's specialized responses to security
vulnerabilities.

View Responses

RESOURCES

* Security Blog
* Security Measurement
* Severity Ratings
* Backporting Policies
* Product Signing (GPG) Keys

* Community

CUSTOMER PORTAL COMMUNITY

* Discussions
* Private Groups

Community Activity

CUSTOMER EVENTS

* Red Hat Convergence
* Red Hat Summit

STORIES

* Red Hat Subscription Value
* You Asked. We Acted.
* Open Source Communities

Or troubleshoot an issue.
English

SELECT YOUR LANGUAGE

* English
* Français
* 한국어
* 日本語
* 中文 (中国)

Infrastructure and Management
* Red Hat Enterprise Linux
* Red Hat Satellite
* Red Hat Subscription Management
* Red Hat Insights
* Red Hat Ansible Automation Platform

Cloud Computing
* Red Hat OpenShift
* Red Hat OpenStack Platform
* Red Hat OpenShift Container Platform
* Red Hat OpenShift Data Science
* Red Hat OpenShift Dedicated
* Red Hat Advanced Cluster Security for Kubernetes
* Red Hat Advanced Cluster Management for Kubernetes
* Red Hat Quay
* OpenShift Dev Spaces
* Red Hat OpenShift Service on AWS

Storage
* Red Hat Gluster Storage
* Red Hat Hyperconverged Infrastructure
* Red Hat Ceph Storage
* Red Hat OpenShift Data Foundation

Runtimes
* Red Hat Runtimes
* Red Hat JBoss Enterprise Application Platform
* Red Hat Data Grid
* Red Hat JBoss Web Server
* Red Hat Single Sign On
* Red Hat support for Spring Boot
* Red Hat build of Node.js
* Red Hat build of Quarkus

Integration and Automation
* Red Hat Application Foundations
* Red Hat Fuse
* Red Hat AMQ
* Red Hat 3scale API Management

All Products
All Red Hat
Back to menu

* You are here

RED HAT

Learn about our open source products, services, and company.

* You are here

RED HAT CUSTOMER PORTAL

Get product support and knowledge from the open source experts.

* You are here

RED HAT DEVELOPER

Read developer tutorials and download Red Hat software for cloud application
development.

* You are here

RED HAT PARTNER CONNECT

Become a Red Hat partner and get support in building customer solutions.

--------------------------------------------------------------------------------

* PRODUCTS

* ANSIBLE.COM

Learn about and try our IT automation product.

* TRY, BUY, SELL

* RED HAT HYBRID CLOUD

Access technical how-tos, tutorials, and learning paths focused on Red
Hat’s hybrid cloud managed services.

* RED HAT STORE

Buy select Red Hat products and services online.

* RED HAT MARKETPLACE

Try, buy, sell, and manage certified enterprise software for
container-based environments.

* COMMUNITY & OPEN SOURCE

* THE ENTERPRISERS PROJECT

Read analysis and advice articles written by CIOs, for CIOs.

* OPENSOURCE.COM

Read articles on a range of topics about open source.

* RED HAT SUMMIT

* RED HAT ECOSYSTEM CATALOG

Find hardware, software, and cloud providers―and download container
images―certified to perform with Red Hat technologies.

We're sorry but cve-details doesn't work properly without JavaScript enabled.
Please enable it to continue.

CVE-2023-44487

Public on

Last Modified: UTC

ImportantImportant ImpactWhat does this mean?
7.5CVSS v3 Base ScoreCVSS Score Breakdown

INSIGHTS VULNERABILITY ANALYSIS

View exposed systems

DESCRIPTION

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A
client can repeatedly make a request for a new multiplex stream and immediately
send an RST_STREAM frame to cancel it. This creates extra work for the server
setting up and tearing down the streams while not hitting any server-side limit
for the maximum number of active streams per connection, resulting in a denial
of service due to server resource consumption. Red Hat has rated the severity of
this flaw as 'Important' as the US Cybersecurity and Infrastructure Security
Agency (CISA) declared this vulnerability an active exploit. CVE-2023-39325 was
assigned for the `Rapid Reset Attack` in the Go language packages.

CVE-2023-39325 was assigned for the Rapid Reset Attack in the Go language
packages.

SECURITY BULLETIN

https://access.redhat.com/security/vulnerabilities/RHSB-2023-003

STATEMENT

NGINX has been marked as Moderate Impact because, for performance and resource
consumption reasons, NGINX limits the number of concurrent streams to a default
of 128. In addition, to optimally balance network and server performance, NGINX
allows the client to persist HTTP connections for up to 1000 requests by default
using an HTTP keepalive. The majority of RHEL utilities are not long-running
applications; instead, they are command-line tools. These tools utilize Golang
package as build-time dependency, which is why they are classified as having a
"Moderate" level of impact.

The majority of RHEL utilities are not long-running applications; instead, they
are command-line tools. These tools utilize Golang package as build-time
dependency, which is why they are classified as having a "Moderate" level of
impact.

MITIGATION

Users are strongly urged to update their software as soon as fixes are
available.
There are several mitigation approaches for this flaw.

1. If circumstances permit, users may disable http2 endpoints to circumvent the
flaw altogether until a fix is available.
2. IP-based blocking or flood protection and rate control tools may be used at
network endpoints to filter incoming traffic.
3. Several package specific mitigations are also available.
a. nginx:
https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
b. netty:
https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p
c. haproxy:
https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487
d. nghttp2:
https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg
e. golang: The default stream concurrency limit in golang is 250 streams
(requests) per HTTP/2 connection. This value may be adjusted in the
golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and
the ConfigureServer function which are available in golang.org/x/net/http2.

ADDITIONAL INFORMATION

* Bugzilla 2242803: Multiple HTTP/2 enabled web servers are vulnerable to a
DDoS attack (Rapid Reset Attack)
* CWE-400: Uncontrolled Resource Consumption
* FAQ: Frequently asked questions about CVE-2023-44487

EXTERNAL REFERENCES

https://www.cve.org/CVERecord?id=CVE-2023-44487
https://nvd.nist.gov/vuln/detail/CVE-2023-44487
https://github.com/dotnet/announcements/issues/277
https://pkg.go.dev/vuln/GO-2023-2102
https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/

AFFECTED PACKAGES AND ISSUED RED HAT SECURITY ERRATA

Search:

PlatformPackageStateErrataRelease DateRed Hat Satellite 6.11 for RHEL
7yggdrasil-worker-forwardermoderate
moderate

MODERATE IMPACT

This rating is given to flaws that may be more difficult to exploit but could
still lead to some compromise of the confidentiality, integrity or availability
of resources under certain circumstances. These are the types of vulnerabilities
that could have had a Critical or Important impact but are less easily exploited
based on a technical evaluation of the flaw, and/or affect unlikely
configurations.

FixedRHSA-2023:5980Red Hat Satellite 6.11 for RHEL
8yggdrasil-worker-forwardermoderate
moderate

MODERATE IMPACT

FixedRHSA-2023:5980Red Hat Satellite 6.12 for RHEL
8yggdrasil-worker-forwardermoderate
moderate

MODERATE IMPACT

FixedRHSA-2023:5979Red Hat Satellite 6.13 for RHEL
8yggdrasil-worker-forwardermoderate
moderate

MODERATE IMPACT

FixedRHSA-2023:5931Satellite Client 6 for RHEL
7yggdrasilFixedRHSA-2023:5982Satellite Client 6 for RHEL
8yggdrasilFixedRHSA-2023:5982Satellite Client 6 for RHEL
9yggdrasilFixedRHSA-2023:5982Self Node Remediation 0.5 for RHEL
8workload-availability/self-node-remediation-rhel8-operatorFixedRHSA-2023:6042Self
Node Remediation 0.7 for RHEL
8workload-availability/self-node-remediation-rhel8-operatorFixedRHSA-2023:6041Node
Maintenance Operator 5.0 for RHEL
8workload-availability/node-maintenance-rhel8-operatorFixedRHSA-2023:6039

Show 102550100 entries
FirstPrevious12345…42NextLast
Showing 1 to 10 of 417 entries

Unless explicitly stated as not affected, all previous versions of packages in
any minor update stream of a product listed here should be assumed vulnerable,
although may not have been subject to full analysis.

COMMON VULNERABILITY SCORING SYSTEM (CVSS) SCORE DETAILS

IMPORTANT NOTE

CVSS scores for open source components depend on vendor-specific factors (e.g.
version or build chain). Therefore, Red Hat's score and impact rating can be
different from NVD and other vendors. Red Hat remains the authoritative CVE
Naming Authorities (CNA) source for its products and services (see Red Hat
classifications).

CVSS v3 Score BreakdownRed HatNVDCVSS v3 Base Score7.57.5Attack
VectorNetworkNetworkAttack ComplexityLowLowPrivileges RequiredNoneNoneUser
InteractionNoneNoneScopeUnchangedUnchangedConfidentiality
ImpactNoneNoneIntegrity ImpactNoneNoneAvailability ImpactHighHigh

CVSS V3 VECTOR

Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

FREQUENTLY ASKED QUESTIONS

WHY IS RED HAT'S CVSS V3 SCORE OR IMPACT DIFFERENT FROM OTHER VENDORS?

For open source software shipped by multiple vendors, the CVSS base scores may
vary for each vendor's version depending on the version they ship, how they ship
it, the platform, and even how the software is compiled. This makes scoring of
vulnerabilities difficult for third-party vulnerability databases such as NVD
that only provide a single CVSS base score for each vulnerability. Red Hat
scores reflect how a vulnerability affects our products specifically.

For more information, see https://access.redhat.com/solutions/762393.

MY PRODUCT IS LISTED AS "UNDER INVESTIGATION" OR "AFFECTED", WHEN WILL RED HAT
RELEASE A FIX FOR THIS VULNERABILITY?

* "Under investigation" doesn't necessarily mean that the product is affected
by this vulnerability. It only means that our Analysis Team is still working
on determining whether the product is affected and how it is affected.
* "Affected" means that our Analysis Team has determined that this product is
affected by this vulnerability and might release a fix to address this in the
near future.

WHAT CAN I DO IF MY PRODUCT IS LISTED AS "WILL NOT FIX"?

This depends mostly on the Impact of the vulnerability and the Life Cycle phase
in which your product is currently in. Overall, you have the following options:
* Upgrade to a supported product version that includes a fix for this
vulnerability (recommended)
* Apply a mitigation (if one exists)
* Open a support case to request a prioritization of releasing a fix for this
vulnerability

I HAVE A RED HAT PRODUCT BUT IT IS NOT IN THE ABOVE LIST, IS IT AFFECTED?

The listed products were found to include one or more of the components that
this vulnerability affects. These products underwent a thorough evaluation to
determine their affectedness by this vulnerability. Note that layered products
(such as container-based offerings) that consume affected components from any of
the products listed in this table may be affected and are not represented.

WHY IS MY SECURITY SCANNER REPORTING MY PRODUCT AS VULNERABLE TO THIS
VULNERABILITY EVEN THOUGH MY PRODUCT VERSION IS FIXED OR NOT AFFECTED?

In order to maintain code stability and compatibility, Red Hat usually does not
rebase packages to entirely new versions. Instead, we backport fixes and new
features to an older version of the package we distribute. This can result in
some security scanners that only consider the package version to report the
package as vulnerable. To avoid this, we suggest that you use an OVAL-compatible
security scanner like OpenSCAP.

For more information, see https://www.redhat.com/en/blog/determining-your-risk.

MY PRODUCT IS LISTED AS "OUT OF SUPPORT SCOPE". WHAT DOES THIS MEAN?

When a product is listed as "Out of Support Scope", it means a vulnerability
with the impact level assigned to this CVE is no longer covered by its current
support lifecycle phase. The product has been identified to contain the impacted
component, but analysis to determine whether it is affected or not by this
vulnerability was not performed. The product should be assumed to be affected.
Customers are advised to apply any mitigation options documented on this page,
consider removing or disabling the impacted component, or upgrade to a supported
version of the product that has an update available.

Not sure what something means? Check out our Security Glossary.

This page is generated automatically and has not been checked for errors or
omissions.

For clarification or corrections please contact Red Hat Product Security.

Last Modified: UTC

Red Hat

QUICK LINKS

* Downloads
* Subscriptions
* Support Cases
* Customer Service
* Product Documentation

HELP

* Contact Us
* Customer Portal FAQ
* Log-in Assistance

SITE INFO

* Trust Red Hat
* Browser Support Policy
* Accessibility
* Awards and Recognition
* Colophon

RELATED SITES

* redhat.com
* developers.redhat.com
* connect.redhat.com
* cloud.redhat.com

ABOUT

* Red Hat Subscription Value
* About Red Hat
* Red Hat Jobs

All systems operational
2023
* Privacy Statement
* Terms of Use
* All Policies and Guidelines
* Cookie-präferenzen

We've updated our Privacy Statement effective September 15, 2023.
Red Hat Summit
Twitter

access.redhat.com Open in urlscan Pro 2a02:26f0:1700:11::b856:678d Public Scan

Form analysis 1 forms found in the DOM

Name: topSearchForm — GET /search/browse/search/

Text Content

access.redhat.com Open in urlscan Pro
2a02:26f0:1700:11::b856:678d Public Scan

Form analysis
1 forms found in the DOM