CVE-2023-44487
HighActively exploited (CISA KEV)
Description
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
SeverityHigh
CVSS7.5
Exploit probability100. percentile100%
Product
IETF HTTP/2
PublishedOct 10, 2023
Added to KEVOct 10, 2023
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date: Oct 31, 2023Update
- siemens sinec_ins1.0 or later
- siemens sinec_nms3.0 or later
- siemens st7_scadaconnect1.1 or later
- nghttp2 nghttp21.57.0 or later
- netty netty4.1.100 or later
- eclipse jetty9.4.53, 10.0.17, 11.0.17, 12.0.2 or later
- caddyserver caddy2.7.5 or later
- golang go1.20.10, 1.21.3 or later
- golang http20.17.0 or later
- golang networking0.17.0 or later
- f5 nginx_plusr29 or later
- apple swiftnio_http\/21.28.0 or later
Vendor advisories
- debian.org/security/2023/dsa-5522
- debian.org/security/2023/dsa-5521
- lists.fedoraproject.org/archives/list/[email protected]/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/
- lists.fedoraproject.org/archives/list/[email protected]/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/
- lists.fedoraproject.org/archives/list/[email protected]/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/
- lists.fedoraproject.org/archives/list/[email protected]/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/
- lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/
- lists.fedoraproject.org/archives/list/[email protected]/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/
- lists.fedoraproject.org/archives/list/[email protected]/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/
- lists.fedoraproject.org/archives/list/[email protected]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/
- lists.fedoraproject.org/archives/list/[email protected]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/
- lists.fedoraproject.org/archives/list/[email protected]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ietf http | 2.0 | — |
| siemens simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware | 3.1.5 ≤ v | — |
| siemens sinec_ins | v < 1.0, 1.0 | 1.0 |
| siemens sinec_nms | v < 3.0 | 3.0 |
| siemens st7_scadaconnect | v < 1.1 | 1.1 |
| siemens ruggedcom_ape1808_firmware | No range specified | — |
| siemens simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware | 3.1.5 ≤ v | — |
| siemens siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware | 3.1.5 ≤ v | — |
| nghttp2 nghttp2 | v < 1.57.0 | 1.57.0 |
| netty netty | v < 4.1.100 | 4.1.100 |
| envoyproxy envoy | 1.24.10, 1.25.9, 1.26.4, 1.27.0 | — |
| eclipse jetty | v < 9.4.53, 10.0.0 ≤ v < 10.0.17, 11.0.0 ≤ v < 11.0.17, 12.0.0 ≤ v < 12.0.2 | 9.4.53, 10.0.17, 11.0.17, 12.0.2 |
| caddyserver caddy | v < 2.7.5 | 2.7.5 |
| golang go | v < 1.20.10, 1.21.0 ≤ v < 1.21.3 | 1.20.10, 1.21.3 |
| golang http2 | v < 0.17.0 | 0.17.0 |
| golang networking | v < 0.17.0 | 0.17.0 |
| f5 big-ip_access_policy_manager | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_advanced_firewall_manager | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_advanced_web_application_firewall | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_analytics | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_application_acceleration_manager | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_application_security_manager | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_application_visibility_and_reporting | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_carrier-grade_nat | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_ddos_hybrid_defender | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_domain_name_system | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_fraud_protection_service | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_global_traffic_manager | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_link_controller | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_local_traffic_manager | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_next | 20.0.1 | — |
| f5 big-ip_next_service_proxy_for_kubernetes | 1.5.0 ≤ v ≤ 1.8.2 | — |
| f5 big-ip_policy_enforcement_manager | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_ssl_orchestrator | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_webaccelerator | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 big-ip_websafe | 13.1.0 ≤ v ≤ 13.1.5, 14.1.0 ≤ v ≤ 14.1.5, 15.1.0 ≤ v ≤ 15.1.10, 16.1.0 ≤ v ≤ 16.1.4, 17.1.0 | — |
| f5 nginx | 1.9.5 ≤ v ≤ 1.25.2 | — |
| f5 nginx_ingress_controller | 2.0.0 ≤ v ≤ 2.4.2, 3.0.0 ≤ v ≤ 3.3.0 | — |
| f5 nginx_plus | r25 ≤ v < r29, r29, r30 | r29 |
| apache tomcat | 8.5.0 ≤ v ≤ 8.5.93, 9.0.0 ≤ v ≤ 9.0.80, 10.1.0 ≤ v ≤ 10.1.13, 11.0.0 | — |
| apple swiftnio_http\/2 | v < 1.28.0 | 1.28.0 |
| grpc grpc | v < 1.56.3, v ≤ 1.59.2, 1.58.0 ≤ v < 1.58.3, 1.57.0 | 1.56.3, 1.58.3 |
| microsoft .net | 6.0.0 ≤ v < 6.0.23, 7.0.0 ≤ v < 7.0.12 | 6.0.23, 7.0.12 |
| microsoft asp.net_core | 6.0.0 ≤ v < 6.0.23, 7.0.0 ≤ v < 7.0.12 | 6.0.23, 7.0.12 |
| microsoft azure_kubernetes_service | v < 2023-10-08 | 2023-10-08 |
| microsoft visual_studio_2022 | 17.0 ≤ v < 17.2.20, 17.4 ≤ v < 17.4.12, 17.6 ≤ v < 17.6.8, 17.7 ≤ v < 17.7.5 | 17.2.20, 17.4.12, 17.6.8, 17.7.5 |
| microsoft windows_10_1607 | v < 10.0.14393.6351 | 10.0.14393.6351 |
| microsoft windows_10_1809 | v < 10.0.17763.4974 | 10.0.17763.4974 |
| microsoft windows_10_21h2 | v < 10.0.19044.3570 | 10.0.19044.3570 |
| microsoft windows_10_22h2 | v < 10.0.19045.3570 | 10.0.19045.3570 |
| microsoft windows_11_21h2 | v < 10.0.22000.2538 | 10.0.22000.2538 |
| microsoft windows_11_22h2 | v < 10.0.22621.2428 | 10.0.22621.2428 |
| microsoft windows_server_2016 | No range specified | — |
| microsoft windows_server_2019 | No range specified | — |
| microsoft windows_server_2022 | No range specified | — |
| nodejs node.js | 18.0.0 ≤ v < 18.18.2, 20.0.0 ≤ v < 20.8.1 | 18.18.2, 20.8.1 |
| microsoft cbl-mariner | v < 2023-10-11 | 2023-10-11 |
| dena h2o | v < 2023-10-10 | 2023-10-10 |
| facebook proxygen | v < 2023.10.16.00 | 2023.10.16.00 |
| apache apisix | v < 3.6.1 | 3.6.1 |
| apache traffic_server | 8.0.0 ≤ v < 8.1.9, 9.0.0 ≤ v < 9.2.3 | 8.1.9, 9.2.3 |
| amazon opensearch_data_prepper | v < 2.5.0 | 2.5.0 |
| debian debian_linux | 10.0, 11.0, 12.0 | — |
| kazu-yamamoto http2 | v < 4.2.2 | 4.2.2 |
| istio istio | v < 1.17.6, 1.18.0 ≤ v < 1.18.3, 1.19.0 ≤ v < 1.19.1 | 1.17.6, 1.18.3, 1.19.1 |
| varnish_cache_project varnish_cache | v < 2023-10-10 | 2023-10-10 |
| traefik traefik | v < 2.10.5, 3.0.0 | 2.10.5 |
| projectcontour contour | v < 2023-10-11 | 2023-10-11 |
| linkerd linkerd | 2.12.0 ≤ v ≤ 2.12.5, 2.13.0, 2.13.1, 2.14.0, 2.14.1 | — |
| linecorp armeria | v < 1.26.0 | 1.26.0 |
| redhat 3scale_api_management_platform | 2.0 | — |
| redhat advanced_cluster_management_for_kubernetes | 2.0 | — |
| redhat advanced_cluster_security | 3.0, 4.0 | — |
| redhat ansible_automation_platform | 2.0 | — |
| redhat build_of_optaplanner | 8.0 | — |
| redhat build_of_quarkus | No range specified | — |
| redhat ceph_storage | 5.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.