CVE-2023-45288

Description

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Trends

Current EPSS score: 91.97%• Percentile: 100%

Affected Systems

• chainguard•aactl

  < 0.4.12-r11

• chainguard•actions-runner-controller

  < 0.9.0-r1

• chainguard•actions-runner-controller-fips

  < 0.9.1-r0

• chainguard•addon-resizer

  < 1.8.20-r1

• chainguard•addon-resizer-compat

  < 1.8.20-r1

• chainguard•addon-resizer-fips

  < 1.8.20-r1

• chainguard•addon-resizer-fips-compat

  < 1.8.20-r1

• chainguard•amass

  < 4.2.0-r8

• chainguard•apko

  < 0.14.0-r7

• chainguard•argo-workflows

  < 3.6.5-r2

• chainguard•argo-workflows-fips

  < 3.5.5-r2

• chainguard•atlantis

  < 0.27.2-r2

• chainguard•atlantis-fips

  < 0.27.2-r5

• chainguard•aws-ebs-csi-driver

  < 1.29.1-r1

• chainguard•aws-efs-csi-driver

  < 1.7.7-r1

• chainguard•aws-efs-csi-driver-fips

  < 1.7.0-r8

• chainguard•aws-flb-cloudwatch

  < 1.9.4-r8

• chainguard•aws-flb-firehose

  < 1.7.2-r8

• chainguard•aws-flb-kinesis

  < 1.10.2-r9

• chainguard•aws-load-balancer-controller

  < 2.7.2-r2

• chainguard•aws-load-balancer-controller-compat

  < 2.7.2-r2

• chainguard•aws-load-balancer-controller-fips

  < 2.7.2-r3

• chainguard•aws-network-policy-agent

  < 1.1.0-r1

• chainguard•aws-network-policy-agent-compat

  < 1.1.0-r1

• chainguard•azure-aad-pod-identity-mic

  < 1.8.17-r7

• chainguard•bank-vaults

  < 1.20.4-r12

• chainguard•bank-vaults-fips

  < 1.20.4-r9

• chainguard•bank-vaults-template

  < 1.20.4-r12

• chainguard•bank-vaults-template-fips

  < 1.20.4-r9

• chainguard•bazelisk

  < 1.19.0-r2

• chainguard•bom

  < 0.6.0-r2

• chainguard•boring-registry

  < 0.13.2-r4

• chainguard•boring-registry-fips

  < 0.14.0-r0

• chainguard•buf

  < 1.31.0-r0

• chainguard•buildkitd

  < 0.13.1-r2

• chainguard•caddy

  < 2.7.6-r8

• chainguard•caddy-fips

  < 2.7.6-r5

• chainguard•caddy-man

  < 2.7.6-r8

• chainguard•caddy-src

  < 2.7.6-r8

• chainguard•cadvisor

  < 0.49.1-r5

• chainguard•cadvisor-fips

  < 0.49.1-r4

• chainguard•capslock

  < 0.2.2-r1

• chainguard•cass-operator

  < 1.19.1-r1

• chainguard•cass-operator-fips

  < 1.19.1-r1

• chainguard•cass-operator-fips-no-pvc-delete

  < 1.19.1-r2

• chainguard•cert-exporter

  < 2.12.0-r3

• chainguard•cert-exporter-fips

  < 2.12.0-r4

• chainguard•cert-manager-webhook-pdns

  < 2.5.1-r2

• chainguard•cert-manager-webhook-pdns-fips

  < 2.5.1-r2

• chainguard•certificate-transparency

  < 1.1.8-r1

Showing first 50 affected entries in server-rendered view.

References (55)

• https://go.dev/issue/65051
• https://go.dev/cl/576155
• https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M
• https://pkg.go.dev/vuln/GO-2024-2687
• https://security.netapp.com/advisory/ntap-20240419-0009/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/
• http://www.openwall.com/lists/oss-security/2024/04/05/4
• http://www.openwall.com/lists/oss-security/2024/04/03/16
• https://www.kb.cert.org/vuls/id/421644
• https://nvd.nist.gov/vuln/detail/CVE-2023-45288
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT
• https://nowotarski.info/http2-continuation-flood-technical-details
• https://security.netapp.com/advisory/ntap-20240419-0009
• https://access.redhat.com/errata/RHSA-2024:1892
• https://access.redhat.com/security/updates/classification/#important
• https://bugzilla.redhat.com/show_bug.cgi?id=2268273
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1892.json
• https://access.redhat.com/security/cve/CVE-2023-45288
• https://www.cve.org/CVERecord?id=CVE-2023-45288
• https://nowotarski.info/http2-continuation-flood/
• https://access.redhat.com/errata/RHSA-2024:1899
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1899.json
• https://access.redhat.com/errata/RHSA-2024:1962
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1962.json
• https://access.redhat.com/errata/RHSA-2024:1963
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1963.json
• https://access.redhat.com/errata/RHSA-2024:2079
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2079.json
• https://access.redhat.com/errata/RHSA-2024:2625
• https://issues.redhat.com/browse/HMS-3837
• https://issues.redhat.com/browse/HMS-3983
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2625.json
• https://access.redhat.com/errata/RHSA-2024:2667
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2667.json
• https://access.redhat.com/errata/RHSA-2024:2671
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2671.json
• https://access.redhat.com/errata/RHSA-2024:2699
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2699.json
• https://access.redhat.com/errata/RHSA-2024:2892
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2892.json
• https://access.redhat.com/errata/RHSA-2024:2935
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2935.json
• https://access.redhat.com/errata/RHSA-2024:2936
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2936.json
• https://access.redhat.com/errata/RHSA-2024:4543
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4543.json
• https://access.redhat.com/errata/RHSA-2024:4545
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4545.json
• https://access.redhat.com/errata/RHSA-2024:4546
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4546.json
• https://access.redhat.com/errata/RHSA-2024:4933
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4933.json
• https://access.redhat.com/errata/RHSA-2024:4934
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4934.json
• https://security-tracker.debian.org/tracker/CVE-2023-45288