GHSA-xpw8-rcwv-8f8p

Source

https://github.com/advisories/GHSA-xpw8-rcwv-8f8p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-xpw8-rcwv-8f8p/GHSA-xpw8-rcwv-8f8p.json

Aliases

• BIT-apisix-2023-44487
• BIT-aspnet-core-2023-44487
• BIT-contour-2023-44487
• BIT-dotnet-2023-44487
• BIT-dotnet-sdk-2023-44487
• BIT-envoy-2023-44487
• BIT-golang-2023-44487
• BIT-jenkins-2023-44487
• BIT-kong-2023-44487
• BIT-nginx-2023-44487
• BIT-nginx-ingress-controller-2023-44487
• BIT-node-2023-44487
• BIT-solr-2023-44487
• BIT-tomcat-2023-44487
• BIT-varnish-2023-44487
• CVE-2023-44487
• GHSA-2m7v-gc89-fjqf
• GHSA-qppj-fm5r-hxr3
• GHSA-vx74-f528-fxqg

Published

2023-10-10T22:22:54Z

Modified

2024-02-16T08:23:58.662031Z

Summary

io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack

Details

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Impact

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Patches

This is patched in version 4.1.100.Final.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

References

• https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3
• https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p
• https://nvd.nist.gov/vuln/detail/CVE-2023-44487
• https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
• https://github.com/netty/netty
• https://www.cve.org/CVERecord?id=CVE-2023-44487