ID

VAR-202310-0175

CVE

CVE-2023-44487

TITLE

Debian Security Advisory 5522-3

DESCRIPTION

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. Description: Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. The following advisory data is extracted from: https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_4631.json Red Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment. - Packet Storm Staff ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenShift Dev Spaces 3.15.0 release Advisory ID: RHSA-2024:4631-03 Product: Red Hat OpenShift Dev Spaces Advisory URL: https://access.redhat.com/errata/RHSA-2024:4631 Issue date: 2024-07-18 Revision: 03 CVE Names: CVE-2022-3064 ==================================================================== Summary: Red Hat OpenShift Dev Spaces 3.15 has been released. All containers have been updated to include feature enhancements, bug fixes and CVE fixes. Following the Red Hat Product Security standards this update is rated as having a security impact of Important. The Common Vulnerability Scoring System (CVSS) base score is available for every fixed CVE in the references section. Description: Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development. The 3.15 release is based on Eclipse Che 7.88 and uses the DevWorkspace engine to provide support for workspaces based on devfile v2.1 and v2.2. Users still using the v1 standard should migrate as soon as possible. https://devfile.io/docs/2.2.0/migrating-to-devfile-v2 Dev Spaces releases support the latest two OpenShift 4 EUS releases. Users are expected to update to newer OpenShift releases in order to continue to get Dev Spaces updates. https://access.redhat.com/support/policy/updates/openshift#crw Solution: https://access.redhat.com/articles/11258 CVEs: CVE-2022-3064 References: https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/documentation/en-us/red_hat_openshift_dev_spaces/3.15/html/administration_guide/installing-devspaces https://access.redhat.com/security/cve/CVE-2022-3064 https://access.redhat.com/security/cve/CVE-2022-21698 https://access.redhat.com/security/cve/CVE-2022-28948 https://access.redhat.com/security/cve/CVE-2022-46175 https://access.redhat.com/security/cve/CVE-2023-6378 https://access.redhat.com/security/cve/CVE-2023-39325 https://access.redhat.com/security/cve/CVE-2023-41080 https://access.redhat.com/security/cve/CVE-2023-44487 https://access.redhat.com/security/cve/CVE-2023-45288 https://access.redhat.com/security/cve/CVE-2023-45648 https://issues.redhat.com/browse/CRW-6593 . ========================================================================== Ubuntu Security Notice USN-7067-1 October 14, 2024 haproxy vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS Summary: HAProxy could be made to crash or run programs if it received specially crafted network traffic. Software Description: - haproxy: fast and reliable load balancing reverse proxy Details: It was discovered that HAProxy did not properly limit the creation of new HTTP/2 streams. A remote attacker could possibly use this issue to cause HAProxy to consume excessive resources, leading to a denial of service. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS haproxy 1.8.8-1ubuntu0.13+esm3 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5570-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff December 01, 2023 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : nghttp2 CVE ID : CVE-2023-44487 It was discovered that libnghttp2, a library implementing the HTTP/2 protocol, handled request cancellation incorrectly. This could result in denial of service. For the oldstable distribution (bullseye), this problem has been fixed in version 1.43.0-1+deb11u1. For the stable distribution (bookworm), this problem has been fixed in version 1.52.0-1+deb12u1. We recommend that you upgrade your nghttp2 packages. For the detailed security status of nghttp2 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/nghttp2 Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmVqQcgACgkQEMKTtsN8 TjbEqA//QDCmDN5CLJGvcajpO5Ys2AbOXT+i7cTVhPDjFSnNs0CajiY/ay2qfYNX 2L5Bk5XPbFmLWD1QhvpMysXYFOJKxyqzhhTU23Ha2cQS4M5t2SHzkoKPyD+Vk6wg BF2TwwlZiSJTMcQqMcw2OAUAfwwaxPVIT0wB8VNY/I7HO3pvTKXSFl9Wb0Y2RzZT kL8ci804D57Uqi45dM391V4B3UfoQ/EK+bYhbu8qDfp3/gL7gclRy2+v+by1JwsN RUKM+nbb4eB0L7XM4rWmZrB4o0Tp5KblwNYRmUh7aCxqIuHRvwzRmQYoEB0KXJ7j Udv0/cUISbjkcIZ+lTIduhWRRvQxjo6M9rB0Tk6jFjTwXWRpWKPcYBYz1L8QKN+x lizyctsoT6TJR+IeJmbAfkY8hcTT1j/PZSn1udnRCodpXjUccn8cot4NlU6VWtzw X5hZCYGTlyeY3oKuPusES6bNsYqzJNp4ObU0xOTvES/ru8Zmiz/76Eufg3+oDo3S gYKVFcchgp0mk20owdWHTadQpIfQFoJkL2FWYWFhXuTGTe30R9bsMIbDddaD3cYs 6p7AiwYljhYYWqaVmRCAhiGerpun18NZhKUlV7ZMF8yQflrVddPqoVTVQEpWx6ZL cuJ2u/oag8DdQsfXrQvZWcVWdp77itr+ZeBhm7Xok0+jPDscFDo= =P2Nw -----END PGP SIGNATURE----- . Description: Red Hat AMQ Streams, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. A wrong value for the overheadcount variable forced HTTP2 connections to close early. Description: Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Description: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.11.54. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2023:7479 Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.11 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Description: nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Description: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library. Description: This asynchronous patch is a security update zip for the JBoss EAP XP 4.0.0 runtime distribution for use with EAP 7.4.13

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

info disclosure

EXTERNAL IDS

REFERENCES