ID

VAR-202310-0175

CVE

CVE-2023-44487

TITLE

Gentoo Linux Security Advisory 202311-09

DESCRIPTION

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202311-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Go: Multiple Vulnerabilities Date: November 25, 2023 Bugs: #873637, #883783, #894478, #903979, #908255, #915555, #916494 ID: 202311-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been discovered in Go, the worst of which could lead to remote code execution. Background ========= Go is an open source programming language that makes it easy to build simple, reliable, and efficient software. Affected packages ================ Package Vulnerable Unaffected ----------- ------------ ------------ dev-lang/go < 1.20.10 >= 1.20.10 Description ========== Multiple vulnerabilities have been discovered in Go. Please review the CVE identifiers referenced below for details. Impact ===== Please review the referenced CVE identifiers for details. Workaround ========= There is no known workaround at this time. Resolution ========= All Go users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">\xdev-lang/go-1.20.10" # emerge --ask --oneshot --verbose @golang-rebuild References ========= [ 1 ] CVE-2022-2879 https://nvd.nist.gov/vuln/detail/CVE-2022-2879 [ 2 ] CVE-2022-2880 https://nvd.nist.gov/vuln/detail/CVE-2022-2880 [ 3 ] CVE-2022-41715 https://nvd.nist.gov/vuln/detail/CVE-2022-41715 [ 4 ] CVE-2022-41717 https://nvd.nist.gov/vuln/detail/CVE-2022-41717 [ 5 ] CVE-2022-41723 https://nvd.nist.gov/vuln/detail/CVE-2022-41723 [ 6 ] CVE-2022-41724 https://nvd.nist.gov/vuln/detail/CVE-2022-41724 [ 7 ] CVE-2022-41725 https://nvd.nist.gov/vuln/detail/CVE-2022-41725 [ 8 ] CVE-2023-24534 https://nvd.nist.gov/vuln/detail/CVE-2023-24534 [ 9 ] CVE-2023-24536 https://nvd.nist.gov/vuln/detail/CVE-2023-24536 [ 10 ] CVE-2023-24537 https://nvd.nist.gov/vuln/detail/CVE-2023-24537 [ 11 ] CVE-2023-24538 https://nvd.nist.gov/vuln/detail/CVE-2023-24538 [ 12 ] CVE-2023-29402 https://nvd.nist.gov/vuln/detail/CVE-2023-29402 [ 13 ] CVE-2023-29403 https://nvd.nist.gov/vuln/detail/CVE-2023-29403 [ 14 ] CVE-2023-29404 https://nvd.nist.gov/vuln/detail/CVE-2023-29404 [ 15 ] CVE-2023-29405 https://nvd.nist.gov/vuln/detail/CVE-2023-29405 [ 16 ] CVE-2023-29406 https://nvd.nist.gov/vuln/detail/CVE-2023-29406 [ 17 ] CVE-2023-29409 https://nvd.nist.gov/vuln/detail/CVE-2023-29409 [ 18 ] CVE-2023-39318 https://nvd.nist.gov/vuln/detail/CVE-2023-39318 [ 19 ] CVE-2023-39319 https://nvd.nist.gov/vuln/detail/CVE-2023-39319 [ 20 ] CVE-2023-39320 https://nvd.nist.gov/vuln/detail/CVE-2023-39320 [ 21 ] CVE-2023-39321 https://nvd.nist.gov/vuln/detail/CVE-2023-39321 [ 22 ] CVE-2023-39322 https://nvd.nist.gov/vuln/detail/CVE-2023-39322 [ 23 ] CVE-2023-39323 https://nvd.nist.gov/vuln/detail/CVE-2023-39323 [ 24 ] CVE-2023-39325 https://nvd.nist.gov/vuln/detail/CVE-2023-39325 [ 25 ] CVE-2023-44487 https://nvd.nist.gov/vuln/detail/CVE-2023-44487 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202311-09 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2023 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5558-1 security@debian.org https://www.debian.org/security/ Markus Koschany November 18, 2023 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : netty CVE ID : CVE-2023-34462 CVE-2023-44487 Debian Bug : 1038947 1054234 Two security vulnerabilities have been discovered in Netty, a Java NIO client/server socket framework. CVE-2023-34462 It might be possible for a remote peer to send a client hello packet during a TLS handshake which lead the server to buffer up to 16 MB of data per connection. This problem is also known as Rapid Reset Attack. For the oldstable distribution (bullseye), these problems have been fixed in version 1:4.1.48-4+deb11u2. For the stable distribution (bookworm), these problems have been fixed in version 1:4.1.48-7+deb12u1. We recommend that you upgrade your netty packages. For the detailed security status of netty please refer to its security tracker page at: https://security-tracker.debian.org/tracker/netty Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmVY5TZfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7 UeRHiBAAzFhW85Ho37J02wrSDVwhIMTsVjNO9lnA08Pswdohr9K1wxeCJ/hBAx97 UNIrjTxyOfCJWi1Kj5pITXEHBRu6w1fj/5y9yoMpAKEu+oGQroHbSf4CPmqP2Of0 eamkfbGx2Dh7Ug3qYxe+elcqRtU3gu8I8DYcWJnm2VpWq7/pbNJ+9iqtmMjhkPLH 1etLI/5HAkwpPimZSrHzcimn39gEVaIbZLc86ZBAoAPghc+iJR1JFHERmkEutWkB eAnL3kD1mr6F711eZvDfPaRfEUVorW67ZEpPX68MJExuYHNXd268EhQOhf/ZYv8g SUSBJuKw4w2OnL4fn8lhqnQgYHUVkcYBtfYii6E9bEVAIPoaT+4gvdSg9zkF6cza Da8SXkEY2ysaX+A24iVnCNMpCMSOUOxWsFFvkCcfi8A4HxGGqWzVOsBbDJKjktS1 g6FyeqWsGh9QG/CPYeMN7LB7lW1l2XzO6GQ9QR1rzU/whgUVxprkye5wx2BaQmom rrWVHBijH1cNWd1IbryAm+prduL1l/CNR0785ZPTjB3SsMFPCAtRHf9G976rqVs0 P3jGg+BdeDj+sd3EFHcHnNXQOaETgR07RWzngbjEkgmJYhB2B43hCQ2LwsNlHsmg O6otUI2k274IF9KHh0T1h1hopbUTU8VPy3dpcLloCzk7KiAv1RI= =4ExT -----END PGP SIGNATURE----- . The purpose of this text-only errata is to inform you about the security issues fixed. Description: This asynchronous patch is a security update zip for the JBoss EAP XP 4.0.0 runtime distribution for use with EAP 7.4.13. Description: nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. ========================================================================== Ubuntu Security Notice USN-6438-2 October 25, 2023 .Net regressions ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 Summary: An incomplete fix was discovered in .Net. Software Description: - dotnet6: dotNET CLI tools and runtime - dotnet7: dotNET CLI tools and runtime Details: USN-6438-1 fixed vulnerabilities in .Net. It was discovered that the fix for [CVE-2023-36799](https://ubuntu.com/security/CVE-2023-36799) was incomplete. This update fixes the problem. Original advisory details: Kevin Jones discovered that .NET did not properly process certain X.509 certificates. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-36799) It was discovered that the .NET Kestrel web server did not properly handle HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-44487) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10: aspnetcore-runtime-6.0 6.0.124-0ubuntu1~23.10.1 aspnetcore-runtime-7.0 7.0.113-0ubuntu1~23.10.1 dotnet-host 6.0.124-0ubuntu1~23.10.1 dotnet-host-7.0 7.0.113-0ubuntu1~23.10.1 dotnet-hostfxr-6.0 6.0.124-0ubuntu1~23.10.1 dotnet-hostfxr-7.0 7.0.113-0ubuntu1~23.10.1 dotnet-runtime-6.0 6.0.124-0ubuntu1~23.10.1 dotnet-runtime-7.0 7.0.113-0ubuntu1~23.10.1 dotnet-sdk-6.0 6.0.124-0ubuntu1~23.10.1 dotnet-sdk-7.0 7.0.113-0ubuntu1~23.10.1 dotnet6 6.0.124-0ubuntu1~23.10.1 dotnet7 7.0.113-0ubuntu1~23.10.1 In general, a standard system update will make all the necessary changes. The following data is constructed from data provided by Red Hat's json file at: https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_6105.json Red Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment. - Packet Storm Staff ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP1 security update Advisory ID: RHSA-2023:6105-01 Product: Red Hat JBoss Core Services Advisory URL: https://access.redhat.com/errata/RHSA-2023:6105 Issue date: 2023-10-26 Revision: 01 CVE Names: CVE-2023-44487 ==================================================================== Summary: An update is now available for Red Hat JBoss Core Services. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description: Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 1 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.57, and includes bug fixes and enhancements, which are documented in the Release Notes linked to in the References section. Security Fix(es): * nghttp2: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) [Major Incident] (CVE-2023-44487) A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section. For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution: https://access.redhat.com/articles/11258 CVEs: CVE-2023-44487 References: https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/RHSB-2023-003 . Description: Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Description: Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

code execution

EXTERNAL IDS

REFERENCES