Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

GHSA-xpw8-rcwv-8f8p

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-xpw8-rcwv-8f8p

io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack. ### Impact This is a DDOS attack, any http2 server is affected and so you should update as soon as possible. ### Patches This is patched in version 4.1.100.Final. ### Workarounds A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own `Http2FrameListener` implementation or an `ChannelInboundHandler` implementation (depending which http2 API is used). ### References - https://www.cve.org/CVERecord?id=CVE-2023-44487 - https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ - https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

gitlab/maven/io.netty/netty-all/CVE-2023-44487

False positive The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

gitlab/maven/io.netty/netty-codec/CVE-2023-44487

False Positive The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

gitlab/maven/io.netty/netty-codec-http2/CVE-2023-44487

Uncontrolled Resource Consumption The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

gitlab/maven/io.netty/netty-codec-http2/GMS-2023-3377

Duplicate This advisory duplicates another.

gitlab/maven/io.netty/netty/CVE-2023-44487

False Positive The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

gitlab/maven/org.apache.solr/solr-core/CVE-2023-44487

Uncontrolled Resource Consumption The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

gitlab/maven/org.eclipse.jetty/jetty-client/CVE-2023-44487

This advisory has been marked as a False Positive and has been removed

gitlab/maven/org.eclipse.jetty/jetty-deploy/CVE-2023-44487

This advisory has been marked as a False Positive and has been removed

gitlab/maven/org.eclipse.jetty/jetty-http/CVE-2023-44487

This advisory has been marked as a False Positive and has been removed

gitlab/maven/org.eclipse.jetty/jetty-io/CVE-2023-44487

This has been marked as a False Positive and has been removed.

gitlab/maven/org.eclipse.jetty/jetty-server/CVE-2023-44487

This advisory has been marked as a False Positive and has been removed

gitlab/maven/org.eclipse.jetty/jetty-servlets/CVE-2023-44487

This advisory has been marked as a False Positive and has been removed

gitlab/maven/org.eclipse.jetty/jetty-util/CVE-2023-44487

This advisory has been marked as a False Positive and has been removed

gitlab/maven/org.eclipse.jetty/jetty-webapp/CVE-2023-44487

This advisory has been marked as a False Positive and has been removed

gitlab/maven/org.jenkins-ci.main/jenkins-core/CVE-2023-44487

Uncontrolled Resource Consumption The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

gitlab/nuget/Microsoft.AspNetCore.All/CVE-2023-44487

Uncontrolled Resource Consumption The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.