Lucene search
AlmaLinuxALSA-2023:6746HistoryNov 07, 2023 - 12:00 a.m.
Important: nghttp2 security update
2023-11-0700:00:00
errata.almalinux.org
40
libnghttp2
http/2
ddos attack
security update
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.4 High
AI Score
Confidence
Low
0.732 High
EPSS
Percentile
98.1%
libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.
Security Fix(es):
- HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| almalinux | 9 | i686 | libnghttp2 | < 1.43.0-5.el9_3.1 | libnghttp2-1.43.0-5.el9_3.1.i686.rpm |
| almalinux | 9 | x86_64 | libnghttp2 | < 1.43.0-5.el9_3.1 | libnghttp2-1.43.0-5.el9_3.1.x86_64.rpm |
| almalinux | 9 | aarch64 | libnghttp2 | < 1.43.0-5.el9_3.1 | libnghttp2-1.43.0-5.el9_3.1.aarch64.rpm |
| almalinux | 9 | ppc64le | libnghttp2 | < 1.43.0-5.el9_3.1 | libnghttp2-1.43.0-5.el9_3.1.ppc64le.rpm |
| almalinux | 9 | s390x | libnghttp2 | < 1.43.0-5.el9_3.1 | libnghttp2-1.43.0-5.el9_3.1.s390x.rpm |
| almalinux | 9 | x86_64 | nghttp2 | < 1.43.0-5.el9_3.1 | nghttp2-1.43.0-5.el9_3.1.x86_64.rpm |
| almalinux | 9 | i686 | libnghttp2-devel | < 1.43.0-5.el9_3.1 | libnghttp2-devel-1.43.0-5.el9_3.1.i686.rpm |
| almalinux | 9 | x86_64 | libnghttp2-devel | < 1.43.0-5.el9_3.1 | libnghttp2-devel-1.43.0-5.el9_3.1.x86_64.rpm |
| almalinux | 9 | aarch64 | libnghttp2-devel | < 1.43.0-5.el9_3.1 | libnghttp2-devel-1.43.0-5.el9_3.1.aarch64.rpm |
| almalinux | 9 | aarch64 | nghttp2 | < 1.43.0-5.el9_3.1 | nghttp2-1.43.0-5.el9_3.1.aarch64.rpm |
Related
nessus
nessus
RHEL 9 : nodejs (RHSA-2023:5765)
2023-10-17 00:00:00
Oracle Linux 8 : nodejs:16 (ELSA-2023-5850)
2023-10-23 00:00:00
Oracle Linux 8 : dotnet7.0 (ELSA-2023-5709)
2023-10-19 00:00:00
oraclelinux
oraclelinux
.NET 7.0 security update
2023-10-18 00:00:00
nghttp2 security update
2023-11-16 00:00:00
nodejs security update
2023-10-20 00:00:00
atlassian
atlassian
osv
osv
BIT-contour-2023-44487
2024-03-06 10:50:58
h2o - security update
2023-10-29 00:00:00
BIT-envoy-2023-44487
2024-03-06 10:52:27
almalinux
almalinux
Important: nghttp2 security update
2023-10-18 00:00:00
Important: varnish security update
2023-10-23 00:00:00
Important: dotnet6.0 security update
2023-10-16 00:00:00
cbl_mariner
cbl_mariner
openvas
openvas
Huawei EulerOS: Security Advisory for nghttp2 (EulerOS-SA-2023-3282)
2023-12-12 00:00:00
Huawei EulerOS: Security Advisory for nghttp2 (EulerOS-SA-2024-1092)
2024-01-09 00:00:00
Huawei EulerOS: Security Advisory for nghttp2 (EulerOS-SA-2024-1365)
2024-03-14 00:00:00
amazon
amazon
Important: nghttp2
2023-10-16 13:45:00
rocky
rocky
varnish security update
2023-10-24 18:36:42
varnish security update
2023-10-24 18:35:47
nodejs security update
2023-10-24 18:36:46
fedora
fedora
[SECURITY] Fedora 39 Update: proxygen-2023.10.16.00-1.fc39
2023-11-03 19:01:54
[SECURITY] Fedora 38 Update: wangle-2023.10.16.00-1.fc38
2023-10-24 01:23:49
[SECURITY] Fedora 38 Update: fbthrift-2023.10.16.00-1.fc38
2023-10-24 01:23:49
redos
redos
ROS-20231107-01
2023-11-07 00:00:00
ibm
ibm
github
github
HTTP/2 Stream Cancellation Attack
2023-10-10 21:28:24
github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset
2023-10-10 18:23:21
debian
debian
[SECURITY] [DLA 3617-2] tomcat9 regression update
2023-10-16 22:23:23
[SECURITY] [DLA 3638-1] h2o security update
2023-10-31 14:09:23
veracode
veracode
Denial Of Service (DoS)
2023-10-12 14:37:40
redhat
redhat
(RHSA-2023:5716) Important: Red Hat Data Grid 8.4.5 security update
2023-10-16 14:21:45
(RHSA-2023:5768) Important: nghttp2 security update
2023-10-17 08:51:22
(RHSA-2023:5769) Important: nghttp2 security update
2023-10-17 08:52:38
githubexploit
githubexploit
Exploit for Uncontrolled Resource Consumption in Ietf Http
2023-12-11 23:12:03
talosblog
talosblog
impervablog
impervablog
HTTP/2 Rapid Reset Mitigation With Imperva WAF
2024-01-03 14:21:45
nvd
nvd
CVE-2023-44487
2023-10-10 14:15:10
cisa_kev
cisa_kev
HTTP/2 Rapid Reset Attack Vulnerability
2023-10-10 00:00:00
hivepro
hivepro
Attacks, Vulnerabilities and Actors 9 October to 15 October 2023
2023-10-17 09:10:10
cnvd
cnvd
F5 BIG-IP Denial of Service Vulnerability (CNVD-2023-75597)
2023-10-11 00:00:00
alpinelinux
alpinelinux
CVE-2023-44487
2023-10-10 14:15:10
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.4 High
AI Score
Confidence
Low
0.732 High
EPSS
Percentile
98.1%
Related for ALSA-2023:6746