CVE-2023-44487

Katalog CVE

CVSS 7.5 · High KEV · sudah dieksploitasi EPSS 100,0%

Kerentanan Uncontrolled Resource Consumption pada siemens simatic s7-1500 cpu 1518f-4 pn/dp mfp firmware, siemens sinec ins +21 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD. Masuk katalog KEV CISA pada 10 Oktober 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Rincian

Terbit di NVD

10 Oktober 2023

Terakhir diubah

11 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

100,0% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

HTTP/2 Rapid Reset Attack Vulnerability

Masuk KEV

10 Oktober 2023

Tenggat CISA

31 Oktober 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 300 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/cve-2023-44487 advisory vendor
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ deskripsi teknis · advisory vendor
• https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/ advisory pihak ketiga · advisory vendor
• https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/ advisory vendor
• https://blog.vespa.ai/cve-2023-44487/ advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2242803 issue tracking · advisory vendor
• https://bugzilla.suse.com/show_bug.cgi?id=1216123 issue tracking · advisory vendor
• https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 mailing list · patch · advisory vendor
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-ab... deskripsi teknis · advisory vendor
• https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack deskripsi teknis · advisory vendor
• https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125 advisory vendor
• https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764 advisory vendor
• https://github.com/advisories/GHSA-qppj-fm5r-hxr3 advisory vendor
• https://github.com/advisories/GHSA-vx74-f528-fxqg mitigasi · patch · advisory vendor
• https://github.com/advisories/GHSA-xpw8-rcwv-8f8p patch · advisory vendor
• https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487 advisory vendor
• https://github.com/caddyserver/caddy/issues/5877 issue tracking · advisory vendor
• https://github.com/dotnet/announcements/issues/277 issue tracking · mitigasi · advisory vendor
• https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf advisory vendor
• https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo mailing list · release notes · advisory vendor
• https://istio.io/latest/news/security/istio-security-2023-004/ advisory vendor
• https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/ advisory vendor
• https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-again... patch · advisory vendor
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487 mitigasi · patch · advisory vendor
• https://my.f5.com/manage/s/article/K000137106 advisory vendor