Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

http: Fix CVE CVE-2023-44487 #30055

Merged
merged 2 commits into from
Oct 10, 2023
Merged

http: Fix CVE CVE-2023-44487 #30055

merged 2 commits into from
Oct 10, 2023

Conversation

phlax
Copy link
Member

@phlax phlax commented Oct 10, 2023

Commit Message:
Additional Description:
Risk Level:
Testing:
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]

@yanavlasov @phlax
Close HTTP connections that prematurely reset streams
6f8a69e 
Signed-off-by: Yan Avlasov <yavlasov@google.com>

Signed-off-by: Ryan Northey <ryan@synca.io>
@yanavlasov @phlax
Limit the number of HTTP requests processed from a connection in I/O …
cf687ac 
…cycle

Signed-off-by: Yan Avlasov <yavlasov@google.com>

Signed-off-by: Ryan Northey <ryan@synca.io>
@repokitteh-read-only
Copy link

CC @envoyproxy/runtime-guard-changes: FYI only for changes made to (source/common/runtime/runtime_features.cc).

🐱

Caused by: #30055 was opened by phlax.

see: more, trace.

wbpcode
wbpcode approved these changes Oct 10, 2023
View reviewed changes
Copy link
Member

@wbpcode wbpcode left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks.

@phlax phlax enabled auto-merge (rebase) October 10, 2023 12:14
@phlax phlax merged commit f737277 into envoyproxy:main Oct 10, 2023
113 of 115 checks passed
@GoVulnBot GoVulnBot mentioned this pull request Oct 10, 2023
Closed
@twghu twghu mentioned this pull request Oct 11, 2023
Closed
@akshaysngupta akshaysngupta mentioned this pull request Oct 11, 2023
Closed
chaudum referenced this pull request in grafana/loki Oct 17, 2023
@renovate
chore(deps): update module golang.org/x/net to v0.17.0 [security] (re…
8879a2d 
…lease-2.8.x) (#10891)

[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| golang.org/x/net | indirect | minor | `v0.7.0` -> `v0.17.0` |

---

### Improper rendering of text nodes in golang.org/x/net/html
[CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) /
[GHSA-2wrh-6pvc-2jm9](https://togithub.com/advisories/GHSA-2wrh-6pvc-2jm9)

<details>
<summary>More information</summary>

#### Details
Text nodes not in the HTML namespace are incorrectly literally rendered,
causing text which should be escaped to not be. This could lead to an
XSS attack.

#### Severity
- CVSS Score: 6.1 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978)
- [https://go.dev/cl/514896](https://go.dev/cl/514896)
- [https://go.dev/issue/61615](https://go.dev/issue/61615)
-
[https://pkg.go.dev/vuln/GO-2023-1988](https://pkg.go.dev/vuln/GO-2023-1988)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-2wrh-6pvc-2jm9) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Improper rendering of text nodes in golang.org/x/net/html
[CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) /
[GHSA-2wrh-6pvc-2jm9](https://togithub.com/advisories/GHSA-2wrh-6pvc-2jm9)
/ [GO-2023-1988](https://pkg.go.dev/vuln/GO-2023-1988)

<details>
<summary>More information</summary>

#### Details
Text nodes not in the HTML namespace are incorrectly literally rendered,
causing text which should be escaped to not be. This could lead to an
XSS attack.

#### Severity
Unknown

#### References
- [https://go.dev/issue/61615](https://go.dev/issue/61615)
- [https://go.dev/cl/514896](https://go.dev/cl/514896)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2023-1988) and the [Go
Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY
4.0](https://togithub.com/golang/vulndb#license)).
</details>

---

### swift-nio-http2 vulnerable to HTTP/2 Stream Cancellation Attack
[CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) /
[GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)

<details>
<summary>More information</summary>

#### Details
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

#### References
-
[https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf](https://togithub.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf)
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487)
-
[https://github.com/Azure/AKS/issues/3947](https://togithub.com/Azure/AKS/issues/3947)
-
[https://github.com/akka/akka-http/issues/4323](https://togithub.com/akka/akka-http/issues/4323)
-
[https://github.com/alibaba/tengine/issues/1872](https://togithub.com/alibaba/tengine/issues/1872)
-
[https://github.com/apache/apisix/issues/10320](https://togithub.com/apache/apisix/issues/10320)
-
[https://github.com/caddyserver/caddy/issues/5877](https://togithub.com/caddyserver/caddy/issues/5877)
-
[https://github.com/dotnet/announcements/issues/277](https://togithub.com/dotnet/announcements/issues/277)
-
[https://github.com/eclipse/jetty.project/issues/10679](https://togithub.com/eclipse/jetty.project/issues/10679)
-
[https://github.com/etcd-io/etcd/issues/16740](https://togithub.com/etcd-io/etcd/issues/16740)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
-
[https://github.com/haproxy/haproxy/issues/2312](https://togithub.com/haproxy/haproxy/issues/2312)
-
[https://github.com/hyperium/hyper/issues/3337](https://togithub.com/hyperium/hyper/issues/3337)
-
[https://github.com/junkurihara/rust-rpxy/issues/97](https://togithub.com/junkurihara/rust-rpxy/issues/97)
-
[https://github.com/kazu-yamamoto/http2/issues/93](https://togithub.com/kazu-yamamoto/http2/issues/93)
-
[https://github.com/ninenines/cowboy/issues/1615](https://togithub.com/ninenines/cowboy/issues/1615)
-
[https://github.com/openresty/openresty/issues/930](https://togithub.com/openresty/openresty/issues/930)
-
[https://github.com/opensearch-project/data-prepper/issues/3474](https://togithub.com/opensearch-project/data-prepper/issues/3474)
-
[https://github.com/tempesta-tech/tempesta/issues/1986](https://togithub.com/tempesta-tech/tempesta/issues/1986)
-
[https://github.com/varnishcache/varnish-cache/issues/3996](https://togithub.com/varnishcache/varnish-cache/issues/3996)
-
[https://github.com/apache/httpd-site/pull/10](https://togithub.com/apache/httpd-site/pull/10)
-
[https://github.com/apache/trafficserver/pull/10564](https://togithub.com/apache/trafficserver/pull/10564)
-
[https://github.com/envoyproxy/envoy/pull/30055](https://togithub.com/envoyproxy/envoy/pull/30055)
-
[https://github.com/facebook/proxygen/pull/466](https://togithub.com/facebook/proxygen/pull/466)
-
[https://github.com/grpc/grpc-go/pull/6703](https://togithub.com/grpc/grpc-go/pull/6703)
-
[https://github.com/h2o/h2o/pull/3291](https://togithub.com/h2o/h2o/pull/3291)
-
[https://github.com/kubernetes/kubernetes/pull/121120](https://togithub.com/kubernetes/kubernetes/pull/121120)
-
[https://github.com/line/armeria/pull/5232](https://togithub.com/line/armeria/pull/5232)
-
[https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632](https://togithub.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632)
-
[https://github.com/microsoft/CBL-Mariner/pull/6381](https://togithub.com/microsoft/CBL-Mariner/pull/6381)
-
[https://github.com/nghttp2/nghttp2/pull/1961](https://togithub.com/nghttp2/nghttp2/pull/1961)
-
[https://github.com/nodejs/node/pull/50121](https://togithub.com/nodejs/node/pull/50121)
-
[https://github.com/projectcontour/contour/pull/5826](https://togithub.com/projectcontour/contour/pull/5826)
-
[https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1](https://togithub.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1)
-
[https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61](https://togithub.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61)
-
[https://access.redhat.com/security/cve/cve-2023-44487](https://access.redhat.com/security/cve/cve-2023-44487)
-
[https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/](https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/)
-
[https://aws.amazon.com/security/security-bulletins/AWS-2023-011/](https://aws.amazon.com/security/security-bulletins/AWS-2023-011/)
-
[https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/)
-
[https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/](https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/)
-
[https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/](https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/)
-
[https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack](https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack)
-
[https://blog.vespa.ai/cve-2023-44487/](https://blog.vespa.ai/cve-2023-44487/)
-
[https://bugzilla.proxmox.com/show_bug.cgi?id=4988](https://bugzilla.proxmox.com/show_bug.cgi?id=4988)
-
[https://bugzilla.redhat.com/show_bug.cgi?id=2242803](https://bugzilla.redhat.com/show_bug.cgi?id=2242803)
-
[https://bugzilla.suse.com/show_bug.cgi?id=1216123](https://bugzilla.suse.com/show_bug.cgi?id=1216123)
-
[https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9](https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9)
-
[https://chaos.social/@&#8203;icing/111210915918780532](https://chaos.social/@&#8203;icing/111210915918780532)
-
[https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/](https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/)
-
[https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack)
-
[https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125](https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125)
-
[https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve](https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve)
-
[https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764](https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764)
-
[https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088](https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088)
-
[https://github.com/Kong/kong/discussions/11741](https://togithub.com/Kong/kong/discussions/11741)
-
[https://github.com/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/advisories/GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
-
[https://github.com/advisories/GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)
-
[https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113](https://togithub.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113)
-
[https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2](https://togithub.com/apache/tomcat/tree/main/java/org/apache/coyote/http2)
-
[https://github.com/apple/swift-nio-http2](https://togithub.com/apple/swift-nio-http2)
-
[https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487](https://togithub.com/arkrwn/PoC/tree/main/CVE-2023-44487)
-
[https://github.com/bcdannyboy/CVE-2023-44487](https://togithub.com/bcdannyboy/CVE-2023-44487)
-
[https://github.com/caddyserver/caddy/releases/tag/v2.7.5](https://togithub.com/caddyserver/caddy/releases/tag/v2.7.5)
-
[https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73](https://togithub.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73)
-
[https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244](https://togithub.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244)
-
[https://github.com/micrictor/http2-rst-stream](https://togithub.com/micrictor/http2-rst-stream)
-
[https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0](https://togithub.com/nghttp2/nghttp2/releases/tag/v1.57.0)
-
[https://github.com/oqtane/oqtane.framework/discussions/3367](https://togithub.com/oqtane/oqtane.framework/discussions/3367)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://istio.io/latest/news/security/istio-security-2023-004/](https://istio.io/latest/news/security/istio-security-2023-004/)
-
[https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/](https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/)
-
[https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q](https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html](https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html)
-
[https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html](https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html)
-
[https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html](https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html)
-
[https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/](https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/)
-
[https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487)
-
[https://my.f5.com/manage/s/article/K000137106](https://my.f5.com/manage/s/article/K000137106)
-
[https://netty.io/news/2023/10/10/4-1-100-Final.html](https://netty.io/news/2023/10/10/4-1-100-Final.html)
-
[https://news.ycombinator.com/item?id=37830987](https://news.ycombinator.com/item?id=37830987)
-
[https://news.ycombinator.com/item?id=37830998](https://news.ycombinator.com/item?id=37830998)
-
[https://news.ycombinator.com/item?id=37831062](https://news.ycombinator.com/item?id=37831062)
-
[https://news.ycombinator.com/item?id=37837043](https://news.ycombinator.com/item?id=37837043)
-
[https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/](https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/)
-
[https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected](https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected)
-
[https://security.netapp.com/advisory/ntap-20231016-0001/](https://security.netapp.com/advisory/ntap-20231016-0001/)
-
[https://security.paloaltonetworks.com/CVE-2023-44487](https://security.paloaltonetworks.com/CVE-2023-44487)
-
[https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14](https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14)
-
[https://ubuntu.com/security/CVE-2023-44487](https://ubuntu.com/security/CVE-2023-44487)
-
[https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/](https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/)
-
[https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487](https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487)
-
[https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event](https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event)
-
[https://www.debian.org/security/2023/dsa-5521](https://www.debian.org/security/2023/dsa-5521)
-
[https://www.debian.org/security/2023/dsa-5522](https://www.debian.org/security/2023/dsa-5522)
-
[https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487](https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487)
-
[https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/](https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/)
-
[https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/](https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/)
-
[https://www.openwall.com/lists/oss-security/2023/10/10/6](https://www.openwall.com/lists/oss-security/2023/10/10/6)
-
[https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack](https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack)
-
[https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/](https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/4](http://www.openwall.com/lists/oss-security/2023/10/13/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/9](http://www.openwall.com/lists/oss-security/2023/10/13/9)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-qppj-fm5r-hxr3) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### HTTP/2 rapid reset can cause excessive work in net/http
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
Moderate

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://pkg.go.dev/vuln/GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)
- [golang.org/x/net](golang.org/x/net)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-4374-p667-p6c8) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### HTTP/2 rapid reset can cause excessive work in net/http
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
Unknown

#### References
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2023-2102) and the [Go
Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY
4.0](https://togithub.com/golang/vulndb#license)).
</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/grafana/loki).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy44LjEiLCJ1cGRhdGVkSW5WZXIiOiIzNy4xOS4yIiwidGFyZ2V0QnJhbmNoIjoicmVsZWFzZS0yLjgueCJ9-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@JuniorHsu
Copy link
Contributor

should we document the stats in docs/root/configuration/http/http_conn_man/stats.rst? I need to blame to find this commit to get more sense on http.downstream_rq_too_many_premature_resets

@egerkke
Copy link

egerkke commented Oct 19, 2023 •
edited
Loading

Hi,

I'm trying to analyze the impact from our users perspective what these new parameters are introducing for them.

overload.premature_reset_min_stream_lifetime_seconds and overload.premature_reset_total_stream_count as I understood are for identifying that rapid reset attack is happening. Or if not the actual attack then some misbehavior of client. Rapid reset

And http.max_requests_per_io_cycle is to help serving requests that are not related to the attack.

But in practice what does this mean:

  • If we set http.max_requests_per_io_cycle to 1 than Envoy will switch between TCP sockets after it processes 1 request in each?
  • Is this switch expected to be costly CPU wise?
  • how does Envoy work without setting these parameters?

Also I couldn't find definition in your repo on what I/O cycle means for you. Can you please explain?

Thanks in advance!

mend-for-github-com bot referenced this pull request in DelineaXPM/dsv-k8s Jan 10, 2024
@mend-for-github-com
chore(deps): update ⬆️ gomod to v0.17.0 (#112)
32db48f 
This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| golang.org/x/net | `v0.13.0` -> `v0.17.0` |
[![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/go/golang.org%2fx%2fnet/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/go/golang.org%2fx%2fnet/v0.13.0/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.13.0/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

#### [CVE-2023-39325](https://togithub.com/golang/go/issues/63417)

A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

####
[CVE-2023-44487](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)

## HTTP/2 Rapid reset attack
The HTTP/2 protocol allows clients to indicate to the server that a
previous stream should be canceled by sending a RST_STREAM frame. The
protocol does not require the client and server to coordinate the
cancellation in any way, the client may do it unilaterally. The client
may also assume that the cancellation will take effect immediately when
the server receives the RST_STREAM frame, before any other data from
that TCP connection is processed.

Abuse of this feature is called a Rapid Reset attack because it relies
on the ability for an endpoint to send a RST_STREAM frame immediately
after sending a request frame, which makes the other endpoint start
working and then rapidly resets the request. The request is canceled,
but leaves the HTTP/2 connection open.

The HTTP/2 Rapid Reset attack built on this capability is simple: The
client opens a large number of streams at once as in the standard HTTP/2
attack, but rather than waiting for a response to each request stream
from the server or proxy, the client cancels each request immediately.

The ability to reset streams immediately allows each connection to have
an indefinite number of requests in flight. By explicitly canceling the
requests, the attacker never exceeds the limit on the number of
concurrent open streams. The number of in-flight requests is no longer
dependent on the round-trip time (RTT), but only on the available
network bandwidth.

In a typical HTTP/2 server implementation, the server will still have to
do significant amounts of work for canceled requests, such as allocating
new stream data structures, parsing the query and doing header
decompression, and mapping the URL to a resource. For reverse proxy
implementations, the request may be proxied to the backend server before
the RST_STREAM frame is processed. The client on the other hand paid
almost no costs for sending the requests. This creates an exploitable
cost asymmetry between the server and the client.

Multiple software artifacts implementing HTTP/2 are affected. This
advisory was originally ingested from the `swift-nio-http2` repo
advisory and their original conent follows.

## swift-nio-http2 specific advisory
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

---

### HTTP/2 rapid reset can cause excessive work in net/http
BIT-golang-2023-39325 /
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/)
-
[https://pkg.go.dev/vuln/GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)
-
[https://security.gentoo.org/glsa/202311-09](https://security.gentoo.org/glsa/202311-09)
-
[https://security.netapp.com/advisory/ntap-20231110-0008/](https://security.netapp.com/advisory/ntap-20231110-0008/)
- [golang.org/x/net](golang.org/x/net)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-4374-p667-p6c8) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### HTTP/2 rapid reset can cause excessive work in net/http
BIT-golang-2023-39325 /
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
Unknown

#### References
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2023-2102) and the [Go
Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY
4.0](https://togithub.com/golang/vulndb#license)).
</details>

---

### HTTP/2 Stream Cancellation Attack
BIT-apisix-2023-44487 / BIT-aspnet-core-2023-44487 /
BIT-contour-2023-44487 / BIT-dotnet-2023-44487 /
BIT-dotnet-sdk-2023-44487 / BIT-envoy-2023-44487 / BIT-golang-2023-44487
/ BIT-jenkins-2023-44487 / BIT-kong-2023-44487 / BIT-nginx-2023-44487 /
BIT-nginx-ingress-controller-2023-44487 / BIT-node-2023-44487 /
BIT-solr-2023-44487 / BIT-tomcat-2023-44487 / BIT-varnish-2023-44487 /
[CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) /
[GHSA-2m7v-gc89-fjqf](https://togithub.com/advisories/GHSA-2m7v-gc89-fjqf)
/
[GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
/
[GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
/
[GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)

<details>
<summary>More information</summary>

#### Details
##### HTTP/2 Rapid reset attack
The HTTP/2 protocol allows clients to indicate to the server that a
previous stream should be canceled by sending a RST_STREAM frame. The
protocol does not require the client and server to coordinate the
cancellation in any way, the client may do it unilaterally. The client
may also assume that the cancellation will take effect immediately when
the server receives the RST_STREAM frame, before any other data from
that TCP connection is processed.

Abuse of this feature is called a Rapid Reset attack because it relies
on the ability for an endpoint to send a RST_STREAM frame immediately
after sending a request frame, which makes the other endpoint start
working and then rapidly resets the request. The request is canceled,
but leaves the HTTP/2 connection open.

The HTTP/2 Rapid Reset attack built on this capability is simple: The
client opens a large number of streams at once as in the standard HTTP/2
attack, but rather than waiting for a response to each request stream
from the server or proxy, the client cancels each request immediately.

The ability to reset streams immediately allows each connection to have
an indefinite number of requests in flight. By explicitly canceling the
requests, the attacker never exceeds the limit on the number of
concurrent open streams. The number of in-flight requests is no longer
dependent on the round-trip time (RTT), but only on the available
network bandwidth.

In a typical HTTP/2 server implementation, the server will still have to
do significant amounts of work for canceled requests, such as allocating
new stream data structures, parsing the query and doing header
decompression, and mapping the URL to a resource. For reverse proxy
implementations, the request may be proxied to the backend server before
the RST_STREAM frame is processed. The client on the other hand paid
almost no costs for sending the requests. This creates an exploitable
cost asymmetry between the server and the client.

Multiple software artifacts implementing HTTP/2 are affected. This
advisory was originally ingested from the `swift-nio-http2` repo
advisory and their original conent follows.

##### swift-nio-http2 specific advisory
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

#### References
-
[https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf](https://togithub.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf)
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487)
-
[https://github.com/Azure/AKS/issues/3947](https://togithub.com/Azure/AKS/issues/3947)
-
[https://github.com/akka/akka-http/issues/4323](https://togithub.com/akka/akka-http/issues/4323)
-
[https://github.com/alibaba/tengine/issues/1872](https://togithub.com/alibaba/tengine/issues/1872)
-
[https://github.com/apache/apisix/issues/10320](https://togithub.com/apache/apisix/issues/10320)
-
[https://github.com/caddyserver/caddy/issues/5877](https://togithub.com/caddyserver/caddy/issues/5877)
-
[https://github.com/dotnet/announcements/issues/277](https://togithub.com/dotnet/announcements/issues/277)
-
[https://github.com/eclipse/jetty.project/issues/10679](https://togithub.com/eclipse/jetty.project/issues/10679)
-
[https://github.com/etcd-io/etcd/issues/16740](https://togithub.com/etcd-io/etcd/issues/16740)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
-
[https://github.com/haproxy/haproxy/issues/2312](https://togithub.com/haproxy/haproxy/issues/2312)
-
[https://github.com/hyperium/hyper/issues/3337](https://togithub.com/hyperium/hyper/issues/3337)
-
[https://github.com/junkurihara/rust-rpxy/issues/97](https://togithub.com/junkurihara/rust-rpxy/issues/97)
-
[https://github.com/kazu-yamamoto/http2/issues/93](https://togithub.com/kazu-yamamoto/http2/issues/93)
-
[https://github.com/ninenines/cowboy/issues/1615](https://togithub.com/ninenines/cowboy/issues/1615)
-
[https://github.com/openresty/openresty/issues/930](https://togithub.com/openresty/openresty/issues/930)
-
[https://github.com/opensearch-project/data-prepper/issues/3474](https://togithub.com/opensearch-project/data-prepper/issues/3474)
-
[https://github.com/tempesta-tech/tempesta/issues/1986](https://togithub.com/tempesta-tech/tempesta/issues/1986)
-
[https://github.com/varnishcache/varnish-cache/issues/3996](https://togithub.com/varnishcache/varnish-cache/issues/3996)
-
[https://github.com/apache/httpd-site/pull/10](https://togithub.com/apache/httpd-site/pull/10)
-
[https://github.com/apache/trafficserver/pull/10564](https://togithub.com/apache/trafficserver/pull/10564)
-
[https://github.com/envoyproxy/envoy/pull/30055](https://togithub.com/envoyproxy/envoy/pull/30055)
-
[https://github.com/facebook/proxygen/pull/466](https://togithub.com/facebook/proxygen/pull/466)
-
[https://github.com/grpc/grpc-go/pull/6703](https://togithub.com/grpc/grpc-go/pull/6703)
-
[https://github.com/h2o/h2o/pull/3291](https://togithub.com/h2o/h2o/pull/3291)
-
[https://github.com/kubernetes/kubernetes/pull/121120](https://togithub.com/kubernetes/kubernetes/pull/121120)
-
[https://github.com/line/armeria/pull/5232](https://togithub.com/line/armeria/pull/5232)
-
[https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632](https://togithub.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632)
-
[https://github.com/microsoft/CBL-Mariner/pull/6381](https://togithub.com/microsoft/CBL-Mariner/pull/6381)
-
[https://github.com/nghttp2/nghttp2/pull/1961](https://togithub.com/nghttp2/nghttp2/pull/1961)
-
[https://github.com/nodejs/node/pull/50121](https://togithub.com/nodejs/node/pull/50121)
-
[https://github.com/projectcontour/contour/pull/5826](https://togithub.com/projectcontour/contour/pull/5826)
-
[https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1](https://togithub.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1)
-
[https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61](https://togithub.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61)
-
[https://access.redhat.com/security/cve/cve-2023-44487](https://access.redhat.com/security/cve/cve-2023-44487)
-
[https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/](https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/)
-
[https://aws.amazon.com/security/security-bulletins/AWS-2023-011/](https://aws.amazon.com/security/security-bulletins/AWS-2023-011/)
-
[https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/)
-
[https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/](https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/)
-
[https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/](https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/)
-
[https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack](https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack)
-
[https://blog.vespa.ai/cve-2023-44487/](https://blog.vespa.ai/cve-2023-44487/)
-
[https://bugzilla.proxmox.com/show_bug.cgi?id=4988](https://bugzilla.proxmox.com/show_bug.cgi?id=4988)
-
[https://bugzilla.redhat.com/show_bug.cgi?id=2242803](https://bugzilla.redhat.com/show_bug.cgi?id=2242803)
-
[https://bugzilla.suse.com/show_bug.cgi?id=1216123](https://bugzilla.suse.com/show_bug.cgi?id=1216123)
-
[https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9](https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9)
-
[https://chaos.social/@&#8203;icing/111210915918780532](https://chaos.social/@&#8203;icing/111210915918780532)
-
[https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/](https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/)
-
[https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack)
-
[https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125](https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125)
-
[https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715](https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715)
-
[https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve](https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve)
-
[https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764](https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764)
-
[https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088](https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088)
-
[https://github.com/Kong/kong/discussions/11741](https://togithub.com/Kong/kong/discussions/11741)
-
[https://github.com/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/advisories/GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
-
[https://github.com/advisories/GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)
-
[https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113](https://togithub.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113)
-
[https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2](https://togithub.com/apache/tomcat/tree/main/java/org/apache/coyote/http2)
-
[https://github.com/apple/swift-nio-http2](https://togithub.com/apple/swift-nio-http2)
-
[https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487](https://togithub.com/arkrwn/PoC/tree/main/CVE-2023-44487)
-
[https://github.com/bcdannyboy/CVE-2023-44487](https://togithub.com/bcdannyboy/CVE-2023-44487)
-
[https://github.com/caddyserver/caddy/releases/tag/v2.7.5](https://togithub.com/caddyserver/caddy/releases/tag/v2.7.5)
-
[https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73](https://togithub.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73)
-
[https://github.com/grpc/grpc-go/releases](https://togithub.com/grpc/grpc-go/releases)
-
[https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244](https://togithub.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244)
-
[https://github.com/micrictor/http2-rst-stream](https://togithub.com/micrictor/http2-rst-stream)
-
[https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0](https://togithub.com/nghttp2/nghttp2/releases/tag/v1.57.0)
-
[https://github.com/oqtane/oqtane.framework/discussions/3367](https://togithub.com/oqtane/oqtane.framework/discussions/3367)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://istio.io/latest/news/security/istio-security-2023-004/](https://istio.io/latest/news/security/istio-security-2023-004/)
-
[https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/](https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/)
-
[https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q](https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html)
-
[https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html)
-
[https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/)
-
[https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html](https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html)
-
[https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html](https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html)
-
[https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html](https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html)
-
[https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/](https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/)
-
[https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487)
-
[https://my.f5.com/manage/s/article/K000137106](https://my.f5.com/manage/s/article/K000137106)
-
[https://netty.io/news/2023/10/10/4-1-100-Final.html](https://netty.io/news/2023/10/10/4-1-100-Final.html)
-
[https://news.ycombinator.com/item?id=37830987](https://news.ycombinator.com/item?id=37830987)
-
[https://news.ycombinator.com/item?id=37830998](https://news.ycombinator.com/item?id=37830998)
-
[https://news.ycombinator.com/item?id=37831062](https://news.ycombinator.com/item?id=37831062)
-
[https://news.ycombinator.com/item?id=37837043](https://news.ycombinator.com/item?id=37837043)
-
[https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/](https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/)
-
[https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected](https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected)
-
[https://security.gentoo.org/glsa/202311-09](https://security.gentoo.org/glsa/202311-09)
-
[https://security.netapp.com/advisory/ntap-20231016-0001/](https://security.netapp.com/advisory/ntap-20231016-0001/)
-
[https://security.paloaltonetworks.com/CVE-2023-44487](https://security.paloaltonetworks.com/CVE-2023-44487)
-
[https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14](https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14)
-
[https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12](https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12)
-
[https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94](https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94)
-
[https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81](https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81)
-
[https://ubuntu.com/security/CVE-2023-44487](https://ubuntu.com/security/CVE-2023-44487)
-
[https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/](https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/)
-
[https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487](https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487)
-
[https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event](https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event)
-
[https://www.debian.org/security/2023/dsa-5521](https://www.debian.org/security/2023/dsa-5521)
-
[https://www.debian.org/security/2023/dsa-5522](https://www.debian.org/security/2023/dsa-5522)
-
[https://www.debian.org/security/2023/dsa-5540](https://www.debian.org/security/2023/dsa-5540)
-
[https://www.debian.org/security/2023/dsa-5549](https://www.debian.org/security/2023/dsa-5549)
-
[https://www.debian.org/security/2023/dsa-5558](https://www.debian.org/security/2023/dsa-5558)
-
[https://www.debian.org/security/2023/dsa-5570](https://www.debian.org/security/2023/dsa-5570)
-
[https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487](https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487)
-
[https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/](https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/)
-
[https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/](https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/)
-
[https://www.openwall.com/lists/oss-security/2023/10/10/6](https://www.openwall.com/lists/oss-security/2023/10/10/6)
-
[https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack](https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack)
-
[https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/](https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/4](http://www.openwall.com/lists/oss-security/2023/10/13/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/9](http://www.openwall.com/lists/oss-security/2023/10/13/9)
-
[http://www.openwall.com/lists/oss-security/2023/10/18/4](http://www.openwall.com/lists/oss-security/2023/10/18/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/18/8](http://www.openwall.com/lists/oss-security/2023/10/18/8)
-
[http://www.openwall.com/lists/oss-security/2023/10/19/6](http://www.openwall.com/lists/oss-security/2023/10/19/6)
-
[http://www.openwall.com/lists/oss-security/2023/10/20/8](http://www.openwall.com/lists/oss-security/2023/10/20/8)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-qppj-fm5r-hxr3) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy41Mi4wIiwidXBkYXRlZEluVmVyIjoiMzcuMTA4LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=-->

Co-authored-by: mend-for-github-com[bot] <50673670+mend-for-github-com[bot]@users.noreply.github.com>
mend-for-github-com bot referenced this pull request in DelineaXPM/dsv-k8s-sidecar Jan 15, 2024
@mend-for-github-com
chore(deps): update ⬆️ gomod to v0.17.0 (#51)
c0226fe 
This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| golang.org/x/net | `v0.13.0` -> `v0.17.0` |
[![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/go/golang.org%2fx%2fnet/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/go/golang.org%2fx%2fnet/v0.13.0/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.13.0/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

#### [CVE-2023-39325](https://togithub.com/golang/go/issues/63417)

A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

####
[CVE-2023-44487](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)

## HTTP/2 Rapid reset attack
The HTTP/2 protocol allows clients to indicate to the server that a
previous stream should be canceled by sending a RST_STREAM frame. The
protocol does not require the client and server to coordinate the
cancellation in any way, the client may do it unilaterally. The client
may also assume that the cancellation will take effect immediately when
the server receives the RST_STREAM frame, before any other data from
that TCP connection is processed.

Abuse of this feature is called a Rapid Reset attack because it relies
on the ability for an endpoint to send a RST_STREAM frame immediately
after sending a request frame, which makes the other endpoint start
working and then rapidly resets the request. The request is canceled,
but leaves the HTTP/2 connection open.

The HTTP/2 Rapid Reset attack built on this capability is simple: The
client opens a large number of streams at once as in the standard HTTP/2
attack, but rather than waiting for a response to each request stream
from the server or proxy, the client cancels each request immediately.

The ability to reset streams immediately allows each connection to have
an indefinite number of requests in flight. By explicitly canceling the
requests, the attacker never exceeds the limit on the number of
concurrent open streams. The number of in-flight requests is no longer
dependent on the round-trip time (RTT), but only on the available
network bandwidth.

In a typical HTTP/2 server implementation, the server will still have to
do significant amounts of work for canceled requests, such as allocating
new stream data structures, parsing the query and doing header
decompression, and mapping the URL to a resource. For reverse proxy
implementations, the request may be proxied to the backend server before
the RST_STREAM frame is processed. The client on the other hand paid
almost no costs for sending the requests. This creates an exploitable
cost asymmetry between the server and the client.

Multiple software artifacts implementing HTTP/2 are affected. This
advisory was originally ingested from the `swift-nio-http2` repo
advisory and their original conent follows.

## swift-nio-http2 specific advisory
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

---

### HTTP/2 rapid reset can cause excessive work in net/http
BIT-golang-2023-39325 /
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
Unknown

#### References
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2023-2102) and the [Go
Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY
4.0](https://togithub.com/golang/vulndb#license)).
</details>

---

### HTTP/2 Stream Cancellation Attack
BIT-apisix-2023-44487 / BIT-aspnet-core-2023-44487 /
BIT-contour-2023-44487 / BIT-dotnet-2023-44487 /
BIT-dotnet-sdk-2023-44487 / BIT-envoy-2023-44487 / BIT-golang-2023-44487
/ BIT-jenkins-2023-44487 / BIT-kong-2023-44487 / BIT-nginx-2023-44487 /
BIT-nginx-ingress-controller-2023-44487 / BIT-node-2023-44487 /
BIT-solr-2023-44487 / BIT-tomcat-2023-44487 / BIT-varnish-2023-44487 /
[CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) /
[GHSA-2m7v-gc89-fjqf](https://togithub.com/advisories/GHSA-2m7v-gc89-fjqf)
/
[GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
/
[GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
/
[GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)

<details>
<summary>More information</summary>

#### Details
##### HTTP/2 Rapid reset attack
The HTTP/2 protocol allows clients to indicate to the server that a
previous stream should be canceled by sending a RST_STREAM frame. The
protocol does not require the client and server to coordinate the
cancellation in any way, the client may do it unilaterally. The client
may also assume that the cancellation will take effect immediately when
the server receives the RST_STREAM frame, before any other data from
that TCP connection is processed.

Abuse of this feature is called a Rapid Reset attack because it relies
on the ability for an endpoint to send a RST_STREAM frame immediately
after sending a request frame, which makes the other endpoint start
working and then rapidly resets the request. The request is canceled,
but leaves the HTTP/2 connection open.

The HTTP/2 Rapid Reset attack built on this capability is simple: The
client opens a large number of streams at once as in the standard HTTP/2
attack, but rather than waiting for a response to each request stream
from the server or proxy, the client cancels each request immediately.

The ability to reset streams immediately allows each connection to have
an indefinite number of requests in flight. By explicitly canceling the
requests, the attacker never exceeds the limit on the number of
concurrent open streams. The number of in-flight requests is no longer
dependent on the round-trip time (RTT), but only on the available
network bandwidth.

In a typical HTTP/2 server implementation, the server will still have to
do significant amounts of work for canceled requests, such as allocating
new stream data structures, parsing the query and doing header
decompression, and mapping the URL to a resource. For reverse proxy
implementations, the request may be proxied to the backend server before
the RST_STREAM frame is processed. The client on the other hand paid
almost no costs for sending the requests. This creates an exploitable
cost asymmetry between the server and the client.

Multiple software artifacts implementing HTTP/2 are affected. This
advisory was originally ingested from the `swift-nio-http2` repo
advisory and their original conent follows.

##### swift-nio-http2 specific advisory
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

#### References
-
[https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf](https://togithub.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf)
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487)
-
[https://github.com/Azure/AKS/issues/3947](https://togithub.com/Azure/AKS/issues/3947)
-
[https://github.com/akka/akka-http/issues/4323](https://togithub.com/akka/akka-http/issues/4323)
-
[https://github.com/alibaba/tengine/issues/1872](https://togithub.com/alibaba/tengine/issues/1872)
-
[https://github.com/apache/apisix/issues/10320](https://togithub.com/apache/apisix/issues/10320)
-
[https://github.com/caddyserver/caddy/issues/5877](https://togithub.com/caddyserver/caddy/issues/5877)
-
[https://github.com/dotnet/announcements/issues/277](https://togithub.com/dotnet/announcements/issues/277)
-
[https://github.com/eclipse/jetty.project/issues/10679](https://togithub.com/eclipse/jetty.project/issues/10679)
-
[https://github.com/etcd-io/etcd/issues/16740](https://togithub.com/etcd-io/etcd/issues/16740)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
-
[https://github.com/haproxy/haproxy/issues/2312](https://togithub.com/haproxy/haproxy/issues/2312)
-
[https://github.com/hyperium/hyper/issues/3337](https://togithub.com/hyperium/hyper/issues/3337)
-
[https://github.com/junkurihara/rust-rpxy/issues/97](https://togithub.com/junkurihara/rust-rpxy/issues/97)
-
[https://github.com/kazu-yamamoto/http2/issues/93](https://togithub.com/kazu-yamamoto/http2/issues/93)
-
[https://github.com/ninenines/cowboy/issues/1615](https://togithub.com/ninenines/cowboy/issues/1615)
-
[https://github.com/openresty/openresty/issues/930](https://togithub.com/openresty/openresty/issues/930)
-
[https://github.com/opensearch-project/data-prepper/issues/3474](https://togithub.com/opensearch-project/data-prepper/issues/3474)
-
[https://github.com/tempesta-tech/tempesta/issues/1986](https://togithub.com/tempesta-tech/tempesta/issues/1986)
-
[https://github.com/varnishcache/varnish-cache/issues/3996](https://togithub.com/varnishcache/varnish-cache/issues/3996)
-
[https://github.com/apache/httpd-site/pull/10](https://togithub.com/apache/httpd-site/pull/10)
-
[https://github.com/apache/trafficserver/pull/10564](https://togithub.com/apache/trafficserver/pull/10564)
-
[https://github.com/envoyproxy/envoy/pull/30055](https://togithub.com/envoyproxy/envoy/pull/30055)
-
[https://github.com/facebook/proxygen/pull/466](https://togithub.com/facebook/proxygen/pull/466)
-
[https://github.com/grpc/grpc-go/pull/6703](https://togithub.com/grpc/grpc-go/pull/6703)
-
[https://github.com/h2o/h2o/pull/3291](https://togithub.com/h2o/h2o/pull/3291)
-
[https://github.com/kubernetes/kubernetes/pull/121120](https://togithub.com/kubernetes/kubernetes/pull/121120)
-
[https://github.com/line/armeria/pull/5232](https://togithub.com/line/armeria/pull/5232)
-
[https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632](https://togithub.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632)
-
[https://github.com/microsoft/CBL-Mariner/pull/6381](https://togithub.com/microsoft/CBL-Mariner/pull/6381)
-
[https://github.com/nghttp2/nghttp2/pull/1961](https://togithub.com/nghttp2/nghttp2/pull/1961)
-
[https://github.com/nodejs/node/pull/50121](https://togithub.com/nodejs/node/pull/50121)
-
[https://github.com/projectcontour/contour/pull/5826](https://togithub.com/projectcontour/contour/pull/5826)
-
[https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1](https://togithub.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1)
-
[https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61](https://togithub.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61)
-
[https://access.redhat.com/security/cve/cve-2023-44487](https://access.redhat.com/security/cve/cve-2023-44487)
-
[https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/](https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/)
-
[https://aws.amazon.com/security/security-bulletins/AWS-2023-011/](https://aws.amazon.com/security/security-bulletins/AWS-2023-011/)
-
[https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/)
-
[https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/](https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/)
-
[https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/](https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/)
-
[https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack](https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack)
-
[https://blog.vespa.ai/cve-2023-44487/](https://blog.vespa.ai/cve-2023-44487/)
-
[https://bugzilla.proxmox.com/show_bug.cgi?id=4988](https://bugzilla.proxmox.com/show_bug.cgi?id=4988)
-
[https://bugzilla.redhat.com/show_bug.cgi?id=2242803](https://bugzilla.redhat.com/show_bug.cgi?id=2242803)
-
[https://bugzilla.suse.com/show_bug.cgi?id=1216123](https://bugzilla.suse.com/show_bug.cgi?id=1216123)
-
[https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9](https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9)
-
[https://chaos.social/@&#8203;icing/111210915918780532](https://chaos.social/@&#8203;icing/111210915918780532)
-
[https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/](https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/)
-
[https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack)
-
[https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125](https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125)
-
[https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715](https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715)
-
[https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve](https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve)
-
[https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764](https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764)
-
[https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088](https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088)
-
[https://github.com/Kong/kong/discussions/11741](https://togithub.com/Kong/kong/discussions/11741)
-
[https://github.com/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/advisories/GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
-
[https://github.com/advisories/GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)
-
[https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113](https://togithub.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113)
-
[https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2](https://togithub.com/apache/tomcat/tree/main/java/org/apache/coyote/http2)
-
[https://github.com/apple/swift-nio-http2](https://togithub.com/apple/swift-nio-http2)
-
[https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487](https://togithub.com/arkrwn/PoC/tree/main/CVE-2023-44487)
-
[https://github.com/bcdannyboy/CVE-2023-44487](https://togithub.com/bcdannyboy/CVE-2023-44487)
-
[https://github.com/caddyserver/caddy/releases/tag/v2.7.5](https://togithub.com/caddyserver/caddy/releases/tag/v2.7.5)
-
[https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73](https://togithub.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73)
-
[https://github.com/grpc/grpc-go/releases](https://togithub.com/grpc/grpc-go/releases)
-
[https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244](https://togithub.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244)
-
[https://github.com/micrictor/http2-rst-stream](https://togithub.com/micrictor/http2-rst-stream)
-
[https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0](https://togithub.com/nghttp2/nghttp2/releases/tag/v1.57.0)
-
[https://github.com/oqtane/oqtane.framework/discussions/3367](https://togithub.com/oqtane/oqtane.framework/discussions/3367)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://istio.io/latest/news/security/istio-security-2023-004/](https://istio.io/latest/news/security/istio-security-2023-004/)
-
[https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/](https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/)
-
[https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q](https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html)
-
[https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html)
-
[https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/)
-
[https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html](https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html)
-
[https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html](https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html)
-
[https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html](https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html)
-
[https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/](https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/)
-
[https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487)
-
[https://my.f5.com/manage/s/article/K000137106](https://my.f5.com/manage/s/article/K000137106)
-
[https://netty.io/news/2023/10/10/4-1-100-Final.html](https://netty.io/news/2023/10/10/4-1-100-Final.html)
-
[https://news.ycombinator.com/item?id=37830987](https://news.ycombinator.com/item?id=37830987)
-
[https://news.ycombinator.com/item?id=37830998](https://news.ycombinator.com/item?id=37830998)
-
[https://news.ycombinator.com/item?id=37831062](https://news.ycombinator.com/item?id=37831062)
-
[https://news.ycombinator.com/item?id=37837043](https://news.ycombinator.com/item?id=37837043)
-
[https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/](https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/)
-
[https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected](https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected)
-
[https://security.gentoo.org/glsa/202311-09](https://security.gentoo.org/glsa/202311-09)
-
[https://security.netapp.com/advisory/ntap-20231016-0001/](https://security.netapp.com/advisory/ntap-20231016-0001/)
-
[https://security.paloaltonetworks.com/CVE-2023-44487](https://security.paloaltonetworks.com/CVE-2023-44487)
-
[https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14](https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14)
-
[https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12](https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12)
-
[https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94](https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94)
-
[https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81](https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81)
-
[https://ubuntu.com/security/CVE-2023-44487](https://ubuntu.com/security/CVE-2023-44487)
-
[https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/](https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/)
-
[https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487](https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487)
-
[https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event](https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event)
-
[https://www.debian.org/security/2023/dsa-5521](https://www.debian.org/security/2023/dsa-5521)
-
[https://www.debian.org/security/2023/dsa-5522](https://www.debian.org/security/2023/dsa-5522)
-
[https://www.debian.org/security/2023/dsa-5540](https://www.debian.org/security/2023/dsa-5540)
-
[https://www.debian.org/security/2023/dsa-5549](https://www.debian.org/security/2023/dsa-5549)
-
[https://www.debian.org/security/2023/dsa-5558](https://www.debian.org/security/2023/dsa-5558)
-
[https://www.debian.org/security/2023/dsa-5570](https://www.debian.org/security/2023/dsa-5570)
-
[https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487](https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487)
-
[https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/](https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/)
-
[https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/](https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/)
-
[https://www.openwall.com/lists/oss-security/2023/10/10/6](https://www.openwall.com/lists/oss-security/2023/10/10/6)
-
[https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack](https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack)
-
[https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/](https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/4](http://www.openwall.com/lists/oss-security/2023/10/13/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/9](http://www.openwall.com/lists/oss-security/2023/10/13/9)
-
[http://www.openwall.com/lists/oss-security/2023/10/18/4](http://www.openwall.com/lists/oss-security/2023/10/18/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/18/8](http://www.openwall.com/lists/oss-security/2023/10/18/8)
-
[http://www.openwall.com/lists/oss-security/2023/10/19/6](http://www.openwall.com/lists/oss-security/2023/10/19/6)
-
[http://www.openwall.com/lists/oss-security/2023/10/20/8](http://www.openwall.com/lists/oss-security/2023/10/20/8)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-qppj-fm5r-hxr3) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### HTTP/2 rapid reset can cause excessive work in net/http
BIT-golang-2023-39325 /
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/)
-
[https://pkg.go.dev/vuln/GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)
-
[https://security.gentoo.org/glsa/202311-09](https://security.gentoo.org/glsa/202311-09)
-
[https://security.netapp.com/advisory/ntap-20231110-0008/](https://security.netapp.com/advisory/ntap-20231110-0008/)
- [golang.org/x/net](golang.org/x/net)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-4374-p667-p6c8) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [x] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy41Mi4wIiwidXBkYXRlZEluVmVyIjoiMzcuMTA4LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=-->

Co-authored-by: mend-for-github-com[bot] <50673670+mend-for-github-com[bot]@users.noreply.github.com>
@abscondment abscondment mentioned this pull request Feb 24, 2024
Closed
17 tasks
@abscondment abscondment mentioned this pull request Mar 14, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@wbpcode wbpcode wbpcode approved these changes

Assignees

@wbpcode wbpcode

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@phlax @JuniorHsu @egerkke @wbpcode @yanavlasov