csaf_redhat - rhsa-2023

rhsa-2023_6084

Vulnerability from csaf_redhat

Published

2023-10-24 14:57

Modified

2024-12-23 14:15

Summary

Red Hat Security Advisory: RHACS 3.74 enhancement and security update

Notes

Topic

Updated images are now available for Red Hat Advanced Cluster Security. The updated image includes new features and bug fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

This release of RHACS 3.74.7 includes fixes for the following security vulnerabilities: * golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-39325) * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) * Various CVEs in containers for glibc security issues A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section. For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. RHACS 3.74.7 includes a new default policy called "Rapid Reset: Denial of Service Vulnerability in HTTP/2 Protocol". This policy alerts on deployments with images containing components that are susceptible to a Denial of Service (DoS) vulnerability for HTTP/2 servers, based on CVE-2023-44487 and CVE-2023-39325. This policy applies to the build or deploy life cycle stage.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated images are now available for Red Hat Advanced Cluster Security. The\nupdated image includes new features and bug fixes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of RHACS 3.74.7 includes fixes for the following security\nvulnerabilities:\n\n* golang: net/http, x/net/http2: rapid stream resets can cause excessive\nwork\n(CVE-2023-39325)\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS\nattack\n(Rapid Reset Attack) (CVE-2023-44487)\n\n* Various CVEs in containers for glibc security issues\n\nA Red Hat Security Bulletin which addresses further details about this flaw\nis\navailable in the References section.\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s)\nlisted in the References section.\n\nRHACS 3.74.7 includes a new default policy called \"Rapid Reset: Denial of\nService\nVulnerability in HTTP/2 Protocol\". This policy alerts on deployments with\nimages\ncontaining components that are susceptible to a Denial of Service (DoS)\nvulnerability for HTTP/2 servers, based on CVE-2023-44487 and\nCVE-2023-39325.\nThis policy applies to the build or deploy life cycle stage.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2023:6084",
        "url": "https://access.redhat.com/errata/RHSA-2023:6084"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003",
        "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003"
      },
      {
        "category": "external",
        "summary": "https://docs.openshift.com/acs/3.74/release_notes/374-release-notes.html",
        "url": "https://docs.openshift.com/acs/3.74/release_notes/374-release-notes.html"
      },
      {
        "category": "external",
        "summary": "2242803",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803"
      },
      {
        "category": "external",
        "summary": "2243296",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243296"
      },
      {
        "category": "external",
        "summary": "ROX-20195",
        "url": "https://issues.redhat.com/browse/ROX-20195"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6084.json"
      }
    ],
    "title": "Red Hat Security Advisory: RHACS 3.74 enhancement and security update",
    "tracking": {
      "current_release_date": "2024-12-23T14:15:49+00:00",
      "generator": {
        "date": "2024-12-23T14:15:49+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.4"
        }
      },
      "id": "RHSA-2023:6084",
      "initial_release_date": "2023-10-24T14:57:00+00:00",
      "revision_history": [
        {
          "date": "2023-10-24T14:57:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-10-24T14:57:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-23T14:15:49+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHACS 3.74 for RHEL 8",
                "product": {
                  "name": "RHACS 3.74 for RHEL 8",
                  "product_id": "8Base-RHACS-3.74",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:advanced_cluster_security:3.74::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Advanced Cluster Security for Kubernetes"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:f8fa778d169160543339202f870232b6b00a1d01347f4041565cae9acc910ea9_s390x",
                "product": {
                  "name": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:f8fa778d169160543339202f870232b6b00a1d01347f4041565cae9acc910ea9_s390x",
                  "product_id": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:f8fa778d169160543339202f870232b6b00a1d01347f4041565cae9acc910ea9_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-central-db-rhel8@sha256:f8fa778d169160543339202f870232b6b00a1d01347f4041565cae9acc910ea9?arch=s390x\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8\u0026tag=3.74.7-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:6246642e8ac76535613ae5758a0cbc1e408440de2ea2f8cc208c96d7266aac22_s390x",
                "product": {
                  "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:6246642e8ac76535613ae5758a0cbc1e408440de2ea2f8cc208c96d7266aac22_s390x",
                  "product_id": "advanced-cluster-security/rhacs-collector-rhel8@sha256:6246642e8ac76535613ae5758a0cbc1e408440de2ea2f8cc208c96d7266aac22_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-collector-rhel8@sha256:6246642e8ac76535613ae5758a0cbc1e408440de2ea2f8cc208c96d7266aac22?arch=s390x\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8\u0026tag=3.74.7-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:927d84e4c8b52de401106d5aa10605eee94ce911a9d8e81e0c41d3b8beb7c63a_s390x",
                "product": {
                  "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:927d84e4c8b52de401106d5aa10605eee94ce911a9d8e81e0c41d3b8beb7c63a_s390x",
                  "product_id": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:927d84e4c8b52de401106d5aa10605eee94ce911a9d8e81e0c41d3b8beb7c63a_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-collector-slim-rhel8@sha256:927d84e4c8b52de401106d5aa10605eee94ce911a9d8e81e0c41d3b8beb7c63a?arch=s390x\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-collector-slim-rhel8\u0026tag=3.74.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:95265ddc882b2548ed35ae247b283d0f25dce30a3904717396fe17c701d4eb81_s390x",
                "product": {
                  "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:95265ddc882b2548ed35ae247b283d0f25dce30a3904717396fe17c701d4eb81_s390x",
                  "product_id": "advanced-cluster-security/rhacs-main-rhel8@sha256:95265ddc882b2548ed35ae247b283d0f25dce30a3904717396fe17c701d4eb81_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-main-rhel8@sha256:95265ddc882b2548ed35ae247b283d0f25dce30a3904717396fe17c701d4eb81?arch=s390x\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8\u0026tag=3.74.7-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:b8aa66884d5fdfc0383d7a6fdf34418b2c55a00f441fa41a374ca405d7b3f068_s390x",
                "product": {
                  "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:b8aa66884d5fdfc0383d7a6fdf34418b2c55a00f441fa41a374ca405d7b3f068_s390x",
                  "product_id": "advanced-cluster-security/rhacs-operator-bundle@sha256:b8aa66884d5fdfc0383d7a6fdf34418b2c55a00f441fa41a374ca405d7b3f068_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-operator-bundle@sha256:b8aa66884d5fdfc0383d7a6fdf34418b2c55a00f441fa41a374ca405d7b3f068?arch=s390x\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle\u0026tag=3.74.7-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:2adb884147e473b17086eb7cd5462fdd4ab18e6bdc81cd81940001be4a5b67c7_s390x",
                "product": {
                  "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:2adb884147e473b17086eb7cd5462fdd4ab18e6bdc81cd81940001be4a5b67c7_s390x",
                  "product_id": "advanced-cluster-security/rhacs-rhel8-operator@sha256:2adb884147e473b17086eb7cd5462fdd4ab18e6bdc81cd81940001be4a5b67c7_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-rhel8-operator@sha256:2adb884147e473b17086eb7cd5462fdd4ab18e6bdc81cd81940001be4a5b67c7?arch=s390x\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator\u0026tag=3.74.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ce71c4526b7cd5d2bebf771b38e6ac61a12c5dabe3d0f9963e27245944f9e6db_s390x",
                "product": {
                  "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ce71c4526b7cd5d2bebf771b38e6ac61a12c5dabe3d0f9963e27245944f9e6db_s390x",
                  "product_id": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ce71c4526b7cd5d2bebf771b38e6ac61a12c5dabe3d0f9963e27245944f9e6db_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-roxctl-rhel8@sha256:ce71c4526b7cd5d2bebf771b38e6ac61a12c5dabe3d0f9963e27245944f9e6db?arch=s390x\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8\u0026tag=3.74.7-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:8e8acf87581468fd98a97fe28438ea0146b3d8c2b12a322f5c63bf11b4588d81_s390x",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:8e8acf87581468fd98a97fe28438ea0146b3d8c2b12a322f5c63bf11b4588d81_s390x",
                  "product_id": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:8e8acf87581468fd98a97fe28438ea0146b3d8c2b12a322f5c63bf11b4588d81_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-rhel8@sha256:8e8acf87581468fd98a97fe28438ea0146b3d8c2b12a322f5c63bf11b4588d81?arch=s390x\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8\u0026tag=3.74.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ad7c57277851a741e0bc2536f564e86b59be8377366f4b1b7ea79aaa662dc6fa_s390x",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ad7c57277851a741e0bc2536f564e86b59be8377366f4b1b7ea79aaa662dc6fa_s390x",
                  "product_id": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ad7c57277851a741e0bc2536f564e86b59be8377366f4b1b7ea79aaa662dc6fa_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-db-rhel8@sha256:ad7c57277851a741e0bc2536f564e86b59be8377366f4b1b7ea79aaa662dc6fa?arch=s390x\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8\u0026tag=3.74.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:b0d4ba54ba1e9bf8afe640c9c5b2c5eed807c22423a75e39702c033e41c93229_s390x",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:b0d4ba54ba1e9bf8afe640c9c5b2c5eed807c22423a75e39702c033e41c93229_s390x",
                  "product_id": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:b0d4ba54ba1e9bf8afe640c9c5b2c5eed807c22423a75e39702c033e41c93229_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-db-slim-rhel8@sha256:b0d4ba54ba1e9bf8afe640c9c5b2c5eed807c22423a75e39702c033e41c93229?arch=s390x\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8\u0026tag=3.74.7-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:358e601cd9e79a86df7bc735fc593a707ad4fc4e14ed8f39131297a26fb282c3_s390x",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:358e601cd9e79a86df7bc735fc593a707ad4fc4e14ed8f39131297a26fb282c3_s390x",
                  "product_id": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:358e601cd9e79a86df7bc735fc593a707ad4fc4e14ed8f39131297a26fb282c3_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-slim-rhel8@sha256:358e601cd9e79a86df7bc735fc593a707ad4fc4e14ed8f39131297a26fb282c3?arch=s390x\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8\u0026tag=3.74.7-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:c4915dcdfd96742aa5ba9ca38d0de9938ce9c85f6fffa867c35427829ee7462f_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:c4915dcdfd96742aa5ba9ca38d0de9938ce9c85f6fffa867c35427829ee7462f_amd64",
                  "product_id": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:c4915dcdfd96742aa5ba9ca38d0de9938ce9c85f6fffa867c35427829ee7462f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-central-db-rhel8@sha256:c4915dcdfd96742aa5ba9ca38d0de9938ce9c85f6fffa867c35427829ee7462f?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8\u0026tag=3.74.7-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:623ece01f5d7af6844848879985ca0a9a50473cf3e3bb6f4923280948d9ff896_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:623ece01f5d7af6844848879985ca0a9a50473cf3e3bb6f4923280948d9ff896_amd64",
                  "product_id": "advanced-cluster-security/rhacs-collector-rhel8@sha256:623ece01f5d7af6844848879985ca0a9a50473cf3e3bb6f4923280948d9ff896_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-collector-rhel8@sha256:623ece01f5d7af6844848879985ca0a9a50473cf3e3bb6f4923280948d9ff896?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8\u0026tag=3.74.7-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e5bba2853add1a8dee9cd34a542b4baf82a50091a917c83b74ade4298528bd3e_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e5bba2853add1a8dee9cd34a542b4baf82a50091a917c83b74ade4298528bd3e_amd64",
                  "product_id": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e5bba2853add1a8dee9cd34a542b4baf82a50091a917c83b74ade4298528bd3e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-collector-slim-rhel8@sha256:e5bba2853add1a8dee9cd34a542b4baf82a50091a917c83b74ade4298528bd3e?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-collector-slim-rhel8\u0026tag=3.74.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:729e49fb7cfe2bd21541b1e82ccbb77197285aa90486b0c1685379484a956dd9_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:729e49fb7cfe2bd21541b1e82ccbb77197285aa90486b0c1685379484a956dd9_amd64",
                  "product_id": "advanced-cluster-security/rhacs-main-rhel8@sha256:729e49fb7cfe2bd21541b1e82ccbb77197285aa90486b0c1685379484a956dd9_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-main-rhel8@sha256:729e49fb7cfe2bd21541b1e82ccbb77197285aa90486b0c1685379484a956dd9?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8\u0026tag=3.74.7-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:55bea5ed24d5fda12c5a6ac34a908da2c471937fb2c934df1188b806ab56d96e_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:55bea5ed24d5fda12c5a6ac34a908da2c471937fb2c934df1188b806ab56d96e_amd64",
                  "product_id": "advanced-cluster-security/rhacs-operator-bundle@sha256:55bea5ed24d5fda12c5a6ac34a908da2c471937fb2c934df1188b806ab56d96e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-operator-bundle@sha256:55bea5ed24d5fda12c5a6ac34a908da2c471937fb2c934df1188b806ab56d96e?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle\u0026tag=3.74.7-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:373275fba75136a5735ce6a98b94f6b44fc6122d278fdc347f8a8c4740ebcf33_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:373275fba75136a5735ce6a98b94f6b44fc6122d278fdc347f8a8c4740ebcf33_amd64",
                  "product_id": "advanced-cluster-security/rhacs-rhel8-operator@sha256:373275fba75136a5735ce6a98b94f6b44fc6122d278fdc347f8a8c4740ebcf33_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-rhel8-operator@sha256:373275fba75136a5735ce6a98b94f6b44fc6122d278fdc347f8a8c4740ebcf33?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator\u0026tag=3.74.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ad2b63ce031af12d8c31eb40652e324ea9cc5891624c4e1683c00d2948825c0f_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ad2b63ce031af12d8c31eb40652e324ea9cc5891624c4e1683c00d2948825c0f_amd64",
                  "product_id": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ad2b63ce031af12d8c31eb40652e324ea9cc5891624c4e1683c00d2948825c0f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-roxctl-rhel8@sha256:ad2b63ce031af12d8c31eb40652e324ea9cc5891624c4e1683c00d2948825c0f?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8\u0026tag=3.74.7-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:2468f097410bad3de5799b9d46801a04b4580a53d05498dcae37edf73c157826_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:2468f097410bad3de5799b9d46801a04b4580a53d05498dcae37edf73c157826_amd64",
                  "product_id": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:2468f097410bad3de5799b9d46801a04b4580a53d05498dcae37edf73c157826_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-rhel8@sha256:2468f097410bad3de5799b9d46801a04b4580a53d05498dcae37edf73c157826?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8\u0026tag=3.74.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b565441374903dafa3ee00f015cabdf3c16b282d143fb1c9c91dcd126697d71d_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b565441374903dafa3ee00f015cabdf3c16b282d143fb1c9c91dcd126697d71d_amd64",
                  "product_id": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b565441374903dafa3ee00f015cabdf3c16b282d143fb1c9c91dcd126697d71d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-db-rhel8@sha256:b565441374903dafa3ee00f015cabdf3c16b282d143fb1c9c91dcd126697d71d?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8\u0026tag=3.74.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:172711e18b4289efdda02b662beeaa6941f7b41a533410871c9505b76f6a4481_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:172711e18b4289efdda02b662beeaa6941f7b41a533410871c9505b76f6a4481_amd64",
                  "product_id": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:172711e18b4289efdda02b662beeaa6941f7b41a533410871c9505b76f6a4481_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-db-slim-rhel8@sha256:172711e18b4289efdda02b662beeaa6941f7b41a533410871c9505b76f6a4481?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8\u0026tag=3.74.7-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:2a7393086842c64287c32d7cc99ba498c53ec164b3309df59277fb1bef6bbbad_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:2a7393086842c64287c32d7cc99ba498c53ec164b3309df59277fb1bef6bbbad_amd64",
                  "product_id": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:2a7393086842c64287c32d7cc99ba498c53ec164b3309df59277fb1bef6bbbad_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-slim-rhel8@sha256:2a7393086842c64287c32d7cc99ba498c53ec164b3309df59277fb1bef6bbbad?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8\u0026tag=3.74.7-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:4953938e00bf4114fa18e0520ccf20611686da2372615187e5c4f2fdfbb01e06_ppc64le",
                "product": {
                  "name": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:4953938e00bf4114fa18e0520ccf20611686da2372615187e5c4f2fdfbb01e06_ppc64le",
                  "product_id": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:4953938e00bf4114fa18e0520ccf20611686da2372615187e5c4f2fdfbb01e06_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-central-db-rhel8@sha256:4953938e00bf4114fa18e0520ccf20611686da2372615187e5c4f2fdfbb01e06?arch=ppc64le\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8\u0026tag=3.74.7-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:0ae622d315c3f3b23d76b7bc864c8b3d45d53db76a1fcc46d77be0c126bb93ea_ppc64le",
                "product": {
                  "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:0ae622d315c3f3b23d76b7bc864c8b3d45d53db76a1fcc46d77be0c126bb93ea_ppc64le",
                  "product_id": "advanced-cluster-security/rhacs-collector-rhel8@sha256:0ae622d315c3f3b23d76b7bc864c8b3d45d53db76a1fcc46d77be0c126bb93ea_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-collector-rhel8@sha256:0ae622d315c3f3b23d76b7bc864c8b3d45d53db76a1fcc46d77be0c126bb93ea?arch=ppc64le\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8\u0026tag=3.74.7-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8c32a894305bb7fc0ac7ed37872a8dbb09f50c387bd7eb9c955c6cd11c9cf4fe_ppc64le",
                "product": {
                  "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8c32a894305bb7fc0ac7ed37872a8dbb09f50c387bd7eb9c955c6cd11c9cf4fe_ppc64le",
                  "product_id": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8c32a894305bb7fc0ac7ed37872a8dbb09f50c387bd7eb9c955c6cd11c9cf4fe_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-collector-slim-rhel8@sha256:8c32a894305bb7fc0ac7ed37872a8dbb09f50c387bd7eb9c955c6cd11c9cf4fe?arch=ppc64le\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-collector-slim-rhel8\u0026tag=3.74.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:0a7f042c6158dbc550e5f32ecbf5829ed925d2c9fdf30c1705ff4c3ce4bce077_ppc64le",
                "product": {
                  "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:0a7f042c6158dbc550e5f32ecbf5829ed925d2c9fdf30c1705ff4c3ce4bce077_ppc64le",
                  "product_id": "advanced-cluster-security/rhacs-main-rhel8@sha256:0a7f042c6158dbc550e5f32ecbf5829ed925d2c9fdf30c1705ff4c3ce4bce077_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-main-rhel8@sha256:0a7f042c6158dbc550e5f32ecbf5829ed925d2c9fdf30c1705ff4c3ce4bce077?arch=ppc64le\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8\u0026tag=3.74.7-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:42a9acbb0b0a6db326b51044c7e9c99f7a89b5861ac706eab1595b34146b77c4_ppc64le",
                "product": {
                  "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:42a9acbb0b0a6db326b51044c7e9c99f7a89b5861ac706eab1595b34146b77c4_ppc64le",
                  "product_id": "advanced-cluster-security/rhacs-operator-bundle@sha256:42a9acbb0b0a6db326b51044c7e9c99f7a89b5861ac706eab1595b34146b77c4_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-operator-bundle@sha256:42a9acbb0b0a6db326b51044c7e9c99f7a89b5861ac706eab1595b34146b77c4?arch=ppc64le\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle\u0026tag=3.74.7-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:8dd2654d1e078941de8b8cbd1d9aa3348ff8893c35edb5c513116129eae74207_ppc64le",
                "product": {
                  "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:8dd2654d1e078941de8b8cbd1d9aa3348ff8893c35edb5c513116129eae74207_ppc64le",
                  "product_id": "advanced-cluster-security/rhacs-rhel8-operator@sha256:8dd2654d1e078941de8b8cbd1d9aa3348ff8893c35edb5c513116129eae74207_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-rhel8-operator@sha256:8dd2654d1e078941de8b8cbd1d9aa3348ff8893c35edb5c513116129eae74207?arch=ppc64le\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator\u0026tag=3.74.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:060f753e5e57904fd0b3cea1f47f5a45a300ba40c3de448dce04fc4857200127_ppc64le",
                "product": {
                  "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:060f753e5e57904fd0b3cea1f47f5a45a300ba40c3de448dce04fc4857200127_ppc64le",
                  "product_id": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:060f753e5e57904fd0b3cea1f47f5a45a300ba40c3de448dce04fc4857200127_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-roxctl-rhel8@sha256:060f753e5e57904fd0b3cea1f47f5a45a300ba40c3de448dce04fc4857200127?arch=ppc64le\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8\u0026tag=3.74.7-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:f2ebd7e0fba97e74519ce5e05c1a5205e5a76d72ae88e8c83d4722f1f8c8950b_ppc64le",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:f2ebd7e0fba97e74519ce5e05c1a5205e5a76d72ae88e8c83d4722f1f8c8950b_ppc64le",
                  "product_id": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:f2ebd7e0fba97e74519ce5e05c1a5205e5a76d72ae88e8c83d4722f1f8c8950b_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-rhel8@sha256:f2ebd7e0fba97e74519ce5e05c1a5205e5a76d72ae88e8c83d4722f1f8c8950b?arch=ppc64le\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8\u0026tag=3.74.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:83e47a2dc1741bb81aa566f2b310ef0bd47a43792bcca823cdb8ee293c3c3e82_ppc64le",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:83e47a2dc1741bb81aa566f2b310ef0bd47a43792bcca823cdb8ee293c3c3e82_ppc64le",
                  "product_id": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:83e47a2dc1741bb81aa566f2b310ef0bd47a43792bcca823cdb8ee293c3c3e82_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-db-rhel8@sha256:83e47a2dc1741bb81aa566f2b310ef0bd47a43792bcca823cdb8ee293c3c3e82?arch=ppc64le\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8\u0026tag=3.74.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:7c15e7d6064a4f45e6aabb8ff309bd0244ff789ee392815d85f2321a90917929_ppc64le",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:7c15e7d6064a4f45e6aabb8ff309bd0244ff789ee392815d85f2321a90917929_ppc64le",
                  "product_id": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:7c15e7d6064a4f45e6aabb8ff309bd0244ff789ee392815d85f2321a90917929_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-db-slim-rhel8@sha256:7c15e7d6064a4f45e6aabb8ff309bd0244ff789ee392815d85f2321a90917929?arch=ppc64le\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8\u0026tag=3.74.7-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:668c8f074fd4b5ee1cd55f3f4b139965b570b0344e8e3b248cc0fecc14a7e4a6_ppc64le",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:668c8f074fd4b5ee1cd55f3f4b139965b570b0344e8e3b248cc0fecc14a7e4a6_ppc64le",
                  "product_id": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:668c8f074fd4b5ee1cd55f3f4b139965b570b0344e8e3b248cc0fecc14a7e4a6_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-slim-rhel8@sha256:668c8f074fd4b5ee1cd55f3f4b139965b570b0344e8e3b248cc0fecc14a7e4a6?arch=ppc64le\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8\u0026tag=3.74.7-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:4953938e00bf4114fa18e0520ccf20611686da2372615187e5c4f2fdfbb01e06_ppc64le as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:4953938e00bf4114fa18e0520ccf20611686da2372615187e5c4f2fdfbb01e06_ppc64le"
        },
        "product_reference": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:4953938e00bf4114fa18e0520ccf20611686da2372615187e5c4f2fdfbb01e06_ppc64le",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:c4915dcdfd96742aa5ba9ca38d0de9938ce9c85f6fffa867c35427829ee7462f_amd64 as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:c4915dcdfd96742aa5ba9ca38d0de9938ce9c85f6fffa867c35427829ee7462f_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:c4915dcdfd96742aa5ba9ca38d0de9938ce9c85f6fffa867c35427829ee7462f_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:f8fa778d169160543339202f870232b6b00a1d01347f4041565cae9acc910ea9_s390x as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:f8fa778d169160543339202f870232b6b00a1d01347f4041565cae9acc910ea9_s390x"
        },
        "product_reference": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:f8fa778d169160543339202f870232b6b00a1d01347f4041565cae9acc910ea9_s390x",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:0ae622d315c3f3b23d76b7bc864c8b3d45d53db76a1fcc46d77be0c126bb93ea_ppc64le as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:0ae622d315c3f3b23d76b7bc864c8b3d45d53db76a1fcc46d77be0c126bb93ea_ppc64le"
        },
        "product_reference": "advanced-cluster-security/rhacs-collector-rhel8@sha256:0ae622d315c3f3b23d76b7bc864c8b3d45d53db76a1fcc46d77be0c126bb93ea_ppc64le",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:623ece01f5d7af6844848879985ca0a9a50473cf3e3bb6f4923280948d9ff896_amd64 as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:623ece01f5d7af6844848879985ca0a9a50473cf3e3bb6f4923280948d9ff896_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-collector-rhel8@sha256:623ece01f5d7af6844848879985ca0a9a50473cf3e3bb6f4923280948d9ff896_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:6246642e8ac76535613ae5758a0cbc1e408440de2ea2f8cc208c96d7266aac22_s390x as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:6246642e8ac76535613ae5758a0cbc1e408440de2ea2f8cc208c96d7266aac22_s390x"
        },
        "product_reference": "advanced-cluster-security/rhacs-collector-rhel8@sha256:6246642e8ac76535613ae5758a0cbc1e408440de2ea2f8cc208c96d7266aac22_s390x",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8c32a894305bb7fc0ac7ed37872a8dbb09f50c387bd7eb9c955c6cd11c9cf4fe_ppc64le as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8c32a894305bb7fc0ac7ed37872a8dbb09f50c387bd7eb9c955c6cd11c9cf4fe_ppc64le"
        },
        "product_reference": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8c32a894305bb7fc0ac7ed37872a8dbb09f50c387bd7eb9c955c6cd11c9cf4fe_ppc64le",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:927d84e4c8b52de401106d5aa10605eee94ce911a9d8e81e0c41d3b8beb7c63a_s390x as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:927d84e4c8b52de401106d5aa10605eee94ce911a9d8e81e0c41d3b8beb7c63a_s390x"
        },
        "product_reference": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:927d84e4c8b52de401106d5aa10605eee94ce911a9d8e81e0c41d3b8beb7c63a_s390x",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e5bba2853add1a8dee9cd34a542b4baf82a50091a917c83b74ade4298528bd3e_amd64 as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e5bba2853add1a8dee9cd34a542b4baf82a50091a917c83b74ade4298528bd3e_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e5bba2853add1a8dee9cd34a542b4baf82a50091a917c83b74ade4298528bd3e_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:0a7f042c6158dbc550e5f32ecbf5829ed925d2c9fdf30c1705ff4c3ce4bce077_ppc64le as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:0a7f042c6158dbc550e5f32ecbf5829ed925d2c9fdf30c1705ff4c3ce4bce077_ppc64le"
        },
        "product_reference": "advanced-cluster-security/rhacs-main-rhel8@sha256:0a7f042c6158dbc550e5f32ecbf5829ed925d2c9fdf30c1705ff4c3ce4bce077_ppc64le",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:729e49fb7cfe2bd21541b1e82ccbb77197285aa90486b0c1685379484a956dd9_amd64 as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:729e49fb7cfe2bd21541b1e82ccbb77197285aa90486b0c1685379484a956dd9_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-main-rhel8@sha256:729e49fb7cfe2bd21541b1e82ccbb77197285aa90486b0c1685379484a956dd9_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:95265ddc882b2548ed35ae247b283d0f25dce30a3904717396fe17c701d4eb81_s390x as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:95265ddc882b2548ed35ae247b283d0f25dce30a3904717396fe17c701d4eb81_s390x"
        },
        "product_reference": "advanced-cluster-security/rhacs-main-rhel8@sha256:95265ddc882b2548ed35ae247b283d0f25dce30a3904717396fe17c701d4eb81_s390x",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:42a9acbb0b0a6db326b51044c7e9c99f7a89b5861ac706eab1595b34146b77c4_ppc64le as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:42a9acbb0b0a6db326b51044c7e9c99f7a89b5861ac706eab1595b34146b77c4_ppc64le"
        },
        "product_reference": "advanced-cluster-security/rhacs-operator-bundle@sha256:42a9acbb0b0a6db326b51044c7e9c99f7a89b5861ac706eab1595b34146b77c4_ppc64le",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:55bea5ed24d5fda12c5a6ac34a908da2c471937fb2c934df1188b806ab56d96e_amd64 as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:55bea5ed24d5fda12c5a6ac34a908da2c471937fb2c934df1188b806ab56d96e_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-operator-bundle@sha256:55bea5ed24d5fda12c5a6ac34a908da2c471937fb2c934df1188b806ab56d96e_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:b8aa66884d5fdfc0383d7a6fdf34418b2c55a00f441fa41a374ca405d7b3f068_s390x as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:b8aa66884d5fdfc0383d7a6fdf34418b2c55a00f441fa41a374ca405d7b3f068_s390x"
        },
        "product_reference": "advanced-cluster-security/rhacs-operator-bundle@sha256:b8aa66884d5fdfc0383d7a6fdf34418b2c55a00f441fa41a374ca405d7b3f068_s390x",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:2adb884147e473b17086eb7cd5462fdd4ab18e6bdc81cd81940001be4a5b67c7_s390x as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:2adb884147e473b17086eb7cd5462fdd4ab18e6bdc81cd81940001be4a5b67c7_s390x"
        },
        "product_reference": "advanced-cluster-security/rhacs-rhel8-operator@sha256:2adb884147e473b17086eb7cd5462fdd4ab18e6bdc81cd81940001be4a5b67c7_s390x",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:373275fba75136a5735ce6a98b94f6b44fc6122d278fdc347f8a8c4740ebcf33_amd64 as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:373275fba75136a5735ce6a98b94f6b44fc6122d278fdc347f8a8c4740ebcf33_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-rhel8-operator@sha256:373275fba75136a5735ce6a98b94f6b44fc6122d278fdc347f8a8c4740ebcf33_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:8dd2654d1e078941de8b8cbd1d9aa3348ff8893c35edb5c513116129eae74207_ppc64le as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:8dd2654d1e078941de8b8cbd1d9aa3348ff8893c35edb5c513116129eae74207_ppc64le"
        },
        "product_reference": "advanced-cluster-security/rhacs-rhel8-operator@sha256:8dd2654d1e078941de8b8cbd1d9aa3348ff8893c35edb5c513116129eae74207_ppc64le",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:060f753e5e57904fd0b3cea1f47f5a45a300ba40c3de448dce04fc4857200127_ppc64le as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:060f753e5e57904fd0b3cea1f47f5a45a300ba40c3de448dce04fc4857200127_ppc64le"
        },
        "product_reference": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:060f753e5e57904fd0b3cea1f47f5a45a300ba40c3de448dce04fc4857200127_ppc64le",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ad2b63ce031af12d8c31eb40652e324ea9cc5891624c4e1683c00d2948825c0f_amd64 as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ad2b63ce031af12d8c31eb40652e324ea9cc5891624c4e1683c00d2948825c0f_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ad2b63ce031af12d8c31eb40652e324ea9cc5891624c4e1683c00d2948825c0f_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ce71c4526b7cd5d2bebf771b38e6ac61a12c5dabe3d0f9963e27245944f9e6db_s390x as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ce71c4526b7cd5d2bebf771b38e6ac61a12c5dabe3d0f9963e27245944f9e6db_s390x"
        },
        "product_reference": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ce71c4526b7cd5d2bebf771b38e6ac61a12c5dabe3d0f9963e27245944f9e6db_s390x",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:83e47a2dc1741bb81aa566f2b310ef0bd47a43792bcca823cdb8ee293c3c3e82_ppc64le as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:83e47a2dc1741bb81aa566f2b310ef0bd47a43792bcca823cdb8ee293c3c3e82_ppc64le"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:83e47a2dc1741bb81aa566f2b310ef0bd47a43792bcca823cdb8ee293c3c3e82_ppc64le",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ad7c57277851a741e0bc2536f564e86b59be8377366f4b1b7ea79aaa662dc6fa_s390x as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ad7c57277851a741e0bc2536f564e86b59be8377366f4b1b7ea79aaa662dc6fa_s390x"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ad7c57277851a741e0bc2536f564e86b59be8377366f4b1b7ea79aaa662dc6fa_s390x",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b565441374903dafa3ee00f015cabdf3c16b282d143fb1c9c91dcd126697d71d_amd64 as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b565441374903dafa3ee00f015cabdf3c16b282d143fb1c9c91dcd126697d71d_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b565441374903dafa3ee00f015cabdf3c16b282d143fb1c9c91dcd126697d71d_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:172711e18b4289efdda02b662beeaa6941f7b41a533410871c9505b76f6a4481_amd64 as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:172711e18b4289efdda02b662beeaa6941f7b41a533410871c9505b76f6a4481_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:172711e18b4289efdda02b662beeaa6941f7b41a533410871c9505b76f6a4481_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:7c15e7d6064a4f45e6aabb8ff309bd0244ff789ee392815d85f2321a90917929_ppc64le as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:7c15e7d6064a4f45e6aabb8ff309bd0244ff789ee392815d85f2321a90917929_ppc64le"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:7c15e7d6064a4f45e6aabb8ff309bd0244ff789ee392815d85f2321a90917929_ppc64le",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:b0d4ba54ba1e9bf8afe640c9c5b2c5eed807c22423a75e39702c033e41c93229_s390x as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:b0d4ba54ba1e9bf8afe640c9c5b2c5eed807c22423a75e39702c033e41c93229_s390x"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:b0d4ba54ba1e9bf8afe640c9c5b2c5eed807c22423a75e39702c033e41c93229_s390x",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:2468f097410bad3de5799b9d46801a04b4580a53d05498dcae37edf73c157826_amd64 as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:2468f097410bad3de5799b9d46801a04b4580a53d05498dcae37edf73c157826_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:2468f097410bad3de5799b9d46801a04b4580a53d05498dcae37edf73c157826_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:8e8acf87581468fd98a97fe28438ea0146b3d8c2b12a322f5c63bf11b4588d81_s390x as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:8e8acf87581468fd98a97fe28438ea0146b3d8c2b12a322f5c63bf11b4588d81_s390x"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:8e8acf87581468fd98a97fe28438ea0146b3d8c2b12a322f5c63bf11b4588d81_s390x",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:f2ebd7e0fba97e74519ce5e05c1a5205e5a76d72ae88e8c83d4722f1f8c8950b_ppc64le as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:f2ebd7e0fba97e74519ce5e05c1a5205e5a76d72ae88e8c83d4722f1f8c8950b_ppc64le"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:f2ebd7e0fba97e74519ce5e05c1a5205e5a76d72ae88e8c83d4722f1f8c8950b_ppc64le",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:2a7393086842c64287c32d7cc99ba498c53ec164b3309df59277fb1bef6bbbad_amd64 as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:2a7393086842c64287c32d7cc99ba498c53ec164b3309df59277fb1bef6bbbad_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:2a7393086842c64287c32d7cc99ba498c53ec164b3309df59277fb1bef6bbbad_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:358e601cd9e79a86df7bc735fc593a707ad4fc4e14ed8f39131297a26fb282c3_s390x as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:358e601cd9e79a86df7bc735fc593a707ad4fc4e14ed8f39131297a26fb282c3_s390x"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:358e601cd9e79a86df7bc735fc593a707ad4fc4e14ed8f39131297a26fb282c3_s390x",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:668c8f074fd4b5ee1cd55f3f4b139965b570b0344e8e3b248cc0fecc14a7e4a6_ppc64le as a component of RHACS 3.74 for RHEL 8",
          "product_id": "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:668c8f074fd4b5ee1cd55f3f4b139965b570b0344e8e3b248cc0fecc14a7e4a6_ppc64le"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:668c8f074fd4b5ee1cd55f3f4b139965b570b0344e8e3b248cc0fecc14a7e4a6_ppc64le",
        "relates_to_product_reference": "8Base-RHACS-3.74"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-39325",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-10-10T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:4953938e00bf4114fa18e0520ccf20611686da2372615187e5c4f2fdfbb01e06_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:c4915dcdfd96742aa5ba9ca38d0de9938ce9c85f6fffa867c35427829ee7462f_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:f8fa778d169160543339202f870232b6b00a1d01347f4041565cae9acc910ea9_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:0ae622d315c3f3b23d76b7bc864c8b3d45d53db76a1fcc46d77be0c126bb93ea_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:623ece01f5d7af6844848879985ca0a9a50473cf3e3bb6f4923280948d9ff896_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:6246642e8ac76535613ae5758a0cbc1e408440de2ea2f8cc208c96d7266aac22_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8c32a894305bb7fc0ac7ed37872a8dbb09f50c387bd7eb9c955c6cd11c9cf4fe_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:927d84e4c8b52de401106d5aa10605eee94ce911a9d8e81e0c41d3b8beb7c63a_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e5bba2853add1a8dee9cd34a542b4baf82a50091a917c83b74ade4298528bd3e_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:42a9acbb0b0a6db326b51044c7e9c99f7a89b5861ac706eab1595b34146b77c4_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:55bea5ed24d5fda12c5a6ac34a908da2c471937fb2c934df1188b806ab56d96e_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:b8aa66884d5fdfc0383d7a6fdf34418b2c55a00f441fa41a374ca405d7b3f068_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:2adb884147e473b17086eb7cd5462fdd4ab18e6bdc81cd81940001be4a5b67c7_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:373275fba75136a5735ce6a98b94f6b44fc6122d278fdc347f8a8c4740ebcf33_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:8dd2654d1e078941de8b8cbd1d9aa3348ff8893c35edb5c513116129eae74207_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:060f753e5e57904fd0b3cea1f47f5a45a300ba40c3de448dce04fc4857200127_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ad2b63ce031af12d8c31eb40652e324ea9cc5891624c4e1683c00d2948825c0f_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ce71c4526b7cd5d2bebf771b38e6ac61a12c5dabe3d0f9963e27245944f9e6db_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:83e47a2dc1741bb81aa566f2b310ef0bd47a43792bcca823cdb8ee293c3c3e82_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ad7c57277851a741e0bc2536f564e86b59be8377366f4b1b7ea79aaa662dc6fa_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b565441374903dafa3ee00f015cabdf3c16b282d143fb1c9c91dcd126697d71d_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:172711e18b4289efdda02b662beeaa6941f7b41a533410871c9505b76f6a4481_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:7c15e7d6064a4f45e6aabb8ff309bd0244ff789ee392815d85f2321a90917929_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:b0d4ba54ba1e9bf8afe640c9c5b2c5eed807c22423a75e39702c033e41c93229_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:2468f097410bad3de5799b9d46801a04b4580a53d05498dcae37edf73c157826_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:8e8acf87581468fd98a97fe28438ea0146b3d8c2b12a322f5c63bf11b4588d81_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:f2ebd7e0fba97e74519ce5e05c1a5205e5a76d72ae88e8c83d4722f1f8c8950b_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:2a7393086842c64287c32d7cc99ba498c53ec164b3309df59277fb1bef6bbbad_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:358e601cd9e79a86df7bc735fc593a707ad4fc4e14ed8f39131297a26fb282c3_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:668c8f074fd4b5ee1cd55f3f4b139965b570b0344e8e3b248cc0fecc14a7e4a6_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2243296"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as \u0027Important\u0027 as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit.\r\n\r\nCVE-2023-39325 was assigned for the `Rapid Reset Attack` in the Go language packages.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This CVE is related to CVE-2023-44487.\n\nThe majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a \"Moderate\" level of impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:0a7f042c6158dbc550e5f32ecbf5829ed925d2c9fdf30c1705ff4c3ce4bce077_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:729e49fb7cfe2bd21541b1e82ccbb77197285aa90486b0c1685379484a956dd9_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:95265ddc882b2548ed35ae247b283d0f25dce30a3904717396fe17c701d4eb81_s390x"
        ],
        "known_not_affected": [
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:4953938e00bf4114fa18e0520ccf20611686da2372615187e5c4f2fdfbb01e06_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:c4915dcdfd96742aa5ba9ca38d0de9938ce9c85f6fffa867c35427829ee7462f_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:f8fa778d169160543339202f870232b6b00a1d01347f4041565cae9acc910ea9_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:0ae622d315c3f3b23d76b7bc864c8b3d45d53db76a1fcc46d77be0c126bb93ea_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:623ece01f5d7af6844848879985ca0a9a50473cf3e3bb6f4923280948d9ff896_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:6246642e8ac76535613ae5758a0cbc1e408440de2ea2f8cc208c96d7266aac22_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8c32a894305bb7fc0ac7ed37872a8dbb09f50c387bd7eb9c955c6cd11c9cf4fe_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:927d84e4c8b52de401106d5aa10605eee94ce911a9d8e81e0c41d3b8beb7c63a_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e5bba2853add1a8dee9cd34a542b4baf82a50091a917c83b74ade4298528bd3e_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:42a9acbb0b0a6db326b51044c7e9c99f7a89b5861ac706eab1595b34146b77c4_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:55bea5ed24d5fda12c5a6ac34a908da2c471937fb2c934df1188b806ab56d96e_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:b8aa66884d5fdfc0383d7a6fdf34418b2c55a00f441fa41a374ca405d7b3f068_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:2adb884147e473b17086eb7cd5462fdd4ab18e6bdc81cd81940001be4a5b67c7_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:373275fba75136a5735ce6a98b94f6b44fc6122d278fdc347f8a8c4740ebcf33_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:8dd2654d1e078941de8b8cbd1d9aa3348ff8893c35edb5c513116129eae74207_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:060f753e5e57904fd0b3cea1f47f5a45a300ba40c3de448dce04fc4857200127_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ad2b63ce031af12d8c31eb40652e324ea9cc5891624c4e1683c00d2948825c0f_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ce71c4526b7cd5d2bebf771b38e6ac61a12c5dabe3d0f9963e27245944f9e6db_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:83e47a2dc1741bb81aa566f2b310ef0bd47a43792bcca823cdb8ee293c3c3e82_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ad7c57277851a741e0bc2536f564e86b59be8377366f4b1b7ea79aaa662dc6fa_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b565441374903dafa3ee00f015cabdf3c16b282d143fb1c9c91dcd126697d71d_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:172711e18b4289efdda02b662beeaa6941f7b41a533410871c9505b76f6a4481_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:7c15e7d6064a4f45e6aabb8ff309bd0244ff789ee392815d85f2321a90917929_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:b0d4ba54ba1e9bf8afe640c9c5b2c5eed807c22423a75e39702c033e41c93229_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:2468f097410bad3de5799b9d46801a04b4580a53d05498dcae37edf73c157826_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:8e8acf87581468fd98a97fe28438ea0146b3d8c2b12a322f5c63bf11b4588d81_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:f2ebd7e0fba97e74519ce5e05c1a5205e5a76d72ae88e8c83d4722f1f8c8950b_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:2a7393086842c64287c32d7cc99ba498c53ec164b3309df59277fb1bef6bbbad_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:358e601cd9e79a86df7bc735fc593a707ad4fc4e14ed8f39131297a26fb282c3_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:668c8f074fd4b5ee1cd55f3f4b139965b570b0344e8e3b248cc0fecc14a7e4a6_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-39325"
        },
        {
          "category": "external",
          "summary": "RHBZ#2243296",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243296"
        },
        {
          "category": "external",
          "summary": "RHSB-2023-003",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-39325",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-39325"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-39325",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39325"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2023-44487",
          "url": "https://access.redhat.com/security/cve/CVE-2023-44487"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/63417",
          "url": "https://go.dev/issue/63417"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2023-2102",
          "url": "https://pkg.go.dev/vuln/GO-2023-2102"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
          "url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487"
        }
      ],
      "release_date": "2023-10-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-10-24T14:57:00+00:00",
          "details": "If you are using an earlier version of RHACS 3.74, you are advised to upgrade to patch release 3.74.7.",
          "product_ids": [
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:0a7f042c6158dbc550e5f32ecbf5829ed925d2c9fdf30c1705ff4c3ce4bce077_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:729e49fb7cfe2bd21541b1e82ccbb77197285aa90486b0c1685379484a956dd9_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:95265ddc882b2548ed35ae247b283d0f25dce30a3904717396fe17c701d4eb81_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:6084"
        },
        {
          "category": "workaround",
          "details": "The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.",
          "product_ids": [
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:4953938e00bf4114fa18e0520ccf20611686da2372615187e5c4f2fdfbb01e06_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:c4915dcdfd96742aa5ba9ca38d0de9938ce9c85f6fffa867c35427829ee7462f_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:f8fa778d169160543339202f870232b6b00a1d01347f4041565cae9acc910ea9_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:0ae622d315c3f3b23d76b7bc864c8b3d45d53db76a1fcc46d77be0c126bb93ea_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:623ece01f5d7af6844848879985ca0a9a50473cf3e3bb6f4923280948d9ff896_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:6246642e8ac76535613ae5758a0cbc1e408440de2ea2f8cc208c96d7266aac22_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8c32a894305bb7fc0ac7ed37872a8dbb09f50c387bd7eb9c955c6cd11c9cf4fe_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:927d84e4c8b52de401106d5aa10605eee94ce911a9d8e81e0c41d3b8beb7c63a_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e5bba2853add1a8dee9cd34a542b4baf82a50091a917c83b74ade4298528bd3e_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:0a7f042c6158dbc550e5f32ecbf5829ed925d2c9fdf30c1705ff4c3ce4bce077_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:729e49fb7cfe2bd21541b1e82ccbb77197285aa90486b0c1685379484a956dd9_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:95265ddc882b2548ed35ae247b283d0f25dce30a3904717396fe17c701d4eb81_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:42a9acbb0b0a6db326b51044c7e9c99f7a89b5861ac706eab1595b34146b77c4_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:55bea5ed24d5fda12c5a6ac34a908da2c471937fb2c934df1188b806ab56d96e_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:b8aa66884d5fdfc0383d7a6fdf34418b2c55a00f441fa41a374ca405d7b3f068_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:2adb884147e473b17086eb7cd5462fdd4ab18e6bdc81cd81940001be4a5b67c7_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:373275fba75136a5735ce6a98b94f6b44fc6122d278fdc347f8a8c4740ebcf33_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:8dd2654d1e078941de8b8cbd1d9aa3348ff8893c35edb5c513116129eae74207_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:060f753e5e57904fd0b3cea1f47f5a45a300ba40c3de448dce04fc4857200127_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ad2b63ce031af12d8c31eb40652e324ea9cc5891624c4e1683c00d2948825c0f_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ce71c4526b7cd5d2bebf771b38e6ac61a12c5dabe3d0f9963e27245944f9e6db_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:83e47a2dc1741bb81aa566f2b310ef0bd47a43792bcca823cdb8ee293c3c3e82_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ad7c57277851a741e0bc2536f564e86b59be8377366f4b1b7ea79aaa662dc6fa_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b565441374903dafa3ee00f015cabdf3c16b282d143fb1c9c91dcd126697d71d_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:172711e18b4289efdda02b662beeaa6941f7b41a533410871c9505b76f6a4481_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:7c15e7d6064a4f45e6aabb8ff309bd0244ff789ee392815d85f2321a90917929_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:b0d4ba54ba1e9bf8afe640c9c5b2c5eed807c22423a75e39702c033e41c93229_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:2468f097410bad3de5799b9d46801a04b4580a53d05498dcae37edf73c157826_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:8e8acf87581468fd98a97fe28438ea0146b3d8c2b12a322f5c63bf11b4588d81_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:f2ebd7e0fba97e74519ce5e05c1a5205e5a76d72ae88e8c83d4722f1f8c8950b_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:2a7393086842c64287c32d7cc99ba498c53ec164b3309df59277fb1bef6bbbad_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:358e601cd9e79a86df7bc735fc593a707ad4fc4e14ed8f39131297a26fb282c3_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:668c8f074fd4b5ee1cd55f3f4b139965b570b0344e8e3b248cc0fecc14a7e4a6_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:4953938e00bf4114fa18e0520ccf20611686da2372615187e5c4f2fdfbb01e06_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:c4915dcdfd96742aa5ba9ca38d0de9938ce9c85f6fffa867c35427829ee7462f_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:f8fa778d169160543339202f870232b6b00a1d01347f4041565cae9acc910ea9_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:0ae622d315c3f3b23d76b7bc864c8b3d45d53db76a1fcc46d77be0c126bb93ea_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:623ece01f5d7af6844848879985ca0a9a50473cf3e3bb6f4923280948d9ff896_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:6246642e8ac76535613ae5758a0cbc1e408440de2ea2f8cc208c96d7266aac22_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8c32a894305bb7fc0ac7ed37872a8dbb09f50c387bd7eb9c955c6cd11c9cf4fe_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:927d84e4c8b52de401106d5aa10605eee94ce911a9d8e81e0c41d3b8beb7c63a_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e5bba2853add1a8dee9cd34a542b4baf82a50091a917c83b74ade4298528bd3e_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:0a7f042c6158dbc550e5f32ecbf5829ed925d2c9fdf30c1705ff4c3ce4bce077_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:729e49fb7cfe2bd21541b1e82ccbb77197285aa90486b0c1685379484a956dd9_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:95265ddc882b2548ed35ae247b283d0f25dce30a3904717396fe17c701d4eb81_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:42a9acbb0b0a6db326b51044c7e9c99f7a89b5861ac706eab1595b34146b77c4_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:55bea5ed24d5fda12c5a6ac34a908da2c471937fb2c934df1188b806ab56d96e_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:b8aa66884d5fdfc0383d7a6fdf34418b2c55a00f441fa41a374ca405d7b3f068_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:2adb884147e473b17086eb7cd5462fdd4ab18e6bdc81cd81940001be4a5b67c7_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:373275fba75136a5735ce6a98b94f6b44fc6122d278fdc347f8a8c4740ebcf33_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:8dd2654d1e078941de8b8cbd1d9aa3348ff8893c35edb5c513116129eae74207_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:060f753e5e57904fd0b3cea1f47f5a45a300ba40c3de448dce04fc4857200127_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ad2b63ce031af12d8c31eb40652e324ea9cc5891624c4e1683c00d2948825c0f_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ce71c4526b7cd5d2bebf771b38e6ac61a12c5dabe3d0f9963e27245944f9e6db_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:83e47a2dc1741bb81aa566f2b310ef0bd47a43792bcca823cdb8ee293c3c3e82_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ad7c57277851a741e0bc2536f564e86b59be8377366f4b1b7ea79aaa662dc6fa_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b565441374903dafa3ee00f015cabdf3c16b282d143fb1c9c91dcd126697d71d_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:172711e18b4289efdda02b662beeaa6941f7b41a533410871c9505b76f6a4481_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:7c15e7d6064a4f45e6aabb8ff309bd0244ff789ee392815d85f2321a90917929_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:b0d4ba54ba1e9bf8afe640c9c5b2c5eed807c22423a75e39702c033e41c93229_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:2468f097410bad3de5799b9d46801a04b4580a53d05498dcae37edf73c157826_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:8e8acf87581468fd98a97fe28438ea0146b3d8c2b12a322f5c63bf11b4588d81_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:f2ebd7e0fba97e74519ce5e05c1a5205e5a76d72ae88e8c83d4722f1f8c8950b_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:2a7393086842c64287c32d7cc99ba498c53ec164b3309df59277fb1bef6bbbad_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:358e601cd9e79a86df7bc735fc593a707ad4fc4e14ed8f39131297a26fb282c3_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:668c8f074fd4b5ee1cd55f3f4b139965b570b0344e8e3b248cc0fecc14a7e4a6_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)"
    },
    {
      "cve": "CVE-2023-44487",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-10-09T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:4953938e00bf4114fa18e0520ccf20611686da2372615187e5c4f2fdfbb01e06_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:c4915dcdfd96742aa5ba9ca38d0de9938ce9c85f6fffa867c35427829ee7462f_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:f8fa778d169160543339202f870232b6b00a1d01347f4041565cae9acc910ea9_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:0ae622d315c3f3b23d76b7bc864c8b3d45d53db76a1fcc46d77be0c126bb93ea_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:623ece01f5d7af6844848879985ca0a9a50473cf3e3bb6f4923280948d9ff896_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:6246642e8ac76535613ae5758a0cbc1e408440de2ea2f8cc208c96d7266aac22_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8c32a894305bb7fc0ac7ed37872a8dbb09f50c387bd7eb9c955c6cd11c9cf4fe_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:927d84e4c8b52de401106d5aa10605eee94ce911a9d8e81e0c41d3b8beb7c63a_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e5bba2853add1a8dee9cd34a542b4baf82a50091a917c83b74ade4298528bd3e_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:42a9acbb0b0a6db326b51044c7e9c99f7a89b5861ac706eab1595b34146b77c4_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:55bea5ed24d5fda12c5a6ac34a908da2c471937fb2c934df1188b806ab56d96e_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:b8aa66884d5fdfc0383d7a6fdf34418b2c55a00f441fa41a374ca405d7b3f068_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:2adb884147e473b17086eb7cd5462fdd4ab18e6bdc81cd81940001be4a5b67c7_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:373275fba75136a5735ce6a98b94f6b44fc6122d278fdc347f8a8c4740ebcf33_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:8dd2654d1e078941de8b8cbd1d9aa3348ff8893c35edb5c513116129eae74207_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:060f753e5e57904fd0b3cea1f47f5a45a300ba40c3de448dce04fc4857200127_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ad2b63ce031af12d8c31eb40652e324ea9cc5891624c4e1683c00d2948825c0f_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ce71c4526b7cd5d2bebf771b38e6ac61a12c5dabe3d0f9963e27245944f9e6db_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:83e47a2dc1741bb81aa566f2b310ef0bd47a43792bcca823cdb8ee293c3c3e82_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ad7c57277851a741e0bc2536f564e86b59be8377366f4b1b7ea79aaa662dc6fa_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b565441374903dafa3ee00f015cabdf3c16b282d143fb1c9c91dcd126697d71d_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:172711e18b4289efdda02b662beeaa6941f7b41a533410871c9505b76f6a4481_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:7c15e7d6064a4f45e6aabb8ff309bd0244ff789ee392815d85f2321a90917929_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:b0d4ba54ba1e9bf8afe640c9c5b2c5eed807c22423a75e39702c033e41c93229_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:2468f097410bad3de5799b9d46801a04b4580a53d05498dcae37edf73c157826_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:8e8acf87581468fd98a97fe28438ea0146b3d8c2b12a322f5c63bf11b4588d81_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:f2ebd7e0fba97e74519ce5e05c1a5205e5a76d72ae88e8c83d4722f1f8c8950b_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:2a7393086842c64287c32d7cc99ba498c53ec164b3309df59277fb1bef6bbbad_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:358e601cd9e79a86df7bc735fc593a707ad4fc4e14ed8f39131297a26fb282c3_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:668c8f074fd4b5ee1cd55f3f4b139965b570b0344e8e3b248cc0fecc14a7e4a6_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2242803"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as \u0027Important\u0027 as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit.\r\n\r\nCVE-2023-39325 was assigned for the Rapid Reset Attack in the Go language packages.\r\n\r\nSecurity Bulletin\r\nhttps://access.redhat.com/security/vulnerabilities/RHSB-2023-003",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "NGINX has been marked as Moderate Impact because, for performance and resource consumption reasons, NGINX limits the number of concurrent streams to a default of 128. In addition, to optimally balance network and server performance, NGINX allows the client to persist HTTP connections for up to 1000 requests by default using an HTTP keepalive.\n\nThe majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a \"Moderate\" level of impact.\n\nrhc component is no longer impacted by CVE-2023-44487 \u0026 CVE-2023-39325.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:0a7f042c6158dbc550e5f32ecbf5829ed925d2c9fdf30c1705ff4c3ce4bce077_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:729e49fb7cfe2bd21541b1e82ccbb77197285aa90486b0c1685379484a956dd9_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:95265ddc882b2548ed35ae247b283d0f25dce30a3904717396fe17c701d4eb81_s390x"
        ],
        "known_not_affected": [
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:4953938e00bf4114fa18e0520ccf20611686da2372615187e5c4f2fdfbb01e06_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:c4915dcdfd96742aa5ba9ca38d0de9938ce9c85f6fffa867c35427829ee7462f_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:f8fa778d169160543339202f870232b6b00a1d01347f4041565cae9acc910ea9_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:0ae622d315c3f3b23d76b7bc864c8b3d45d53db76a1fcc46d77be0c126bb93ea_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:623ece01f5d7af6844848879985ca0a9a50473cf3e3bb6f4923280948d9ff896_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:6246642e8ac76535613ae5758a0cbc1e408440de2ea2f8cc208c96d7266aac22_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8c32a894305bb7fc0ac7ed37872a8dbb09f50c387bd7eb9c955c6cd11c9cf4fe_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:927d84e4c8b52de401106d5aa10605eee94ce911a9d8e81e0c41d3b8beb7c63a_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e5bba2853add1a8dee9cd34a542b4baf82a50091a917c83b74ade4298528bd3e_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:42a9acbb0b0a6db326b51044c7e9c99f7a89b5861ac706eab1595b34146b77c4_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:55bea5ed24d5fda12c5a6ac34a908da2c471937fb2c934df1188b806ab56d96e_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:b8aa66884d5fdfc0383d7a6fdf34418b2c55a00f441fa41a374ca405d7b3f068_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:2adb884147e473b17086eb7cd5462fdd4ab18e6bdc81cd81940001be4a5b67c7_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:373275fba75136a5735ce6a98b94f6b44fc6122d278fdc347f8a8c4740ebcf33_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:8dd2654d1e078941de8b8cbd1d9aa3348ff8893c35edb5c513116129eae74207_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:060f753e5e57904fd0b3cea1f47f5a45a300ba40c3de448dce04fc4857200127_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ad2b63ce031af12d8c31eb40652e324ea9cc5891624c4e1683c00d2948825c0f_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ce71c4526b7cd5d2bebf771b38e6ac61a12c5dabe3d0f9963e27245944f9e6db_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:83e47a2dc1741bb81aa566f2b310ef0bd47a43792bcca823cdb8ee293c3c3e82_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ad7c57277851a741e0bc2536f564e86b59be8377366f4b1b7ea79aaa662dc6fa_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b565441374903dafa3ee00f015cabdf3c16b282d143fb1c9c91dcd126697d71d_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:172711e18b4289efdda02b662beeaa6941f7b41a533410871c9505b76f6a4481_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:7c15e7d6064a4f45e6aabb8ff309bd0244ff789ee392815d85f2321a90917929_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:b0d4ba54ba1e9bf8afe640c9c5b2c5eed807c22423a75e39702c033e41c93229_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:2468f097410bad3de5799b9d46801a04b4580a53d05498dcae37edf73c157826_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:8e8acf87581468fd98a97fe28438ea0146b3d8c2b12a322f5c63bf11b4588d81_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:f2ebd7e0fba97e74519ce5e05c1a5205e5a76d72ae88e8c83d4722f1f8c8950b_ppc64le",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:2a7393086842c64287c32d7cc99ba498c53ec164b3309df59277fb1bef6bbbad_amd64",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:358e601cd9e79a86df7bc735fc593a707ad4fc4e14ed8f39131297a26fb282c3_s390x",
          "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:668c8f074fd4b5ee1cd55f3f4b139965b570b0344e8e3b248cc0fecc14a7e4a6_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-44487"
        },
        {
          "category": "external",
          "summary": "RHBZ#2242803",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803"
        },
        {
          "category": "external",
          "summary": "RHSB-2023-003",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-44487",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487"
        },
        {
          "category": "external",
          "summary": "https://github.com/dotnet/announcements/issues/277",
          "url": "https://github.com/dotnet/announcements/issues/277"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2023-2102",
          "url": "https://pkg.go.dev/vuln/GO-2023-2102"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
          "url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487"
        },
        {
          "category": "external",
          "summary": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/",
          "url": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2023-10-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-10-24T14:57:00+00:00",
          "details": "If you are using an earlier version of RHACS 3.74, you are advised to upgrade to patch release 3.74.7.",
          "product_ids": [
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:0a7f042c6158dbc550e5f32ecbf5829ed925d2c9fdf30c1705ff4c3ce4bce077_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:729e49fb7cfe2bd21541b1e82ccbb77197285aa90486b0c1685379484a956dd9_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:95265ddc882b2548ed35ae247b283d0f25dce30a3904717396fe17c701d4eb81_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:6084"
        },
        {
          "category": "workaround",
          "details": "Users are strongly urged to update their software as soon as fixes are available. \nThere are several mitigation approaches for this flaw. \n\n1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available.\n2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic.\n3. Several package specific mitigations are also available. \n     a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/\n     b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p\n     c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487\n     d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg\n     e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.",
          "product_ids": [
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:4953938e00bf4114fa18e0520ccf20611686da2372615187e5c4f2fdfbb01e06_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:c4915dcdfd96742aa5ba9ca38d0de9938ce9c85f6fffa867c35427829ee7462f_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:f8fa778d169160543339202f870232b6b00a1d01347f4041565cae9acc910ea9_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:0ae622d315c3f3b23d76b7bc864c8b3d45d53db76a1fcc46d77be0c126bb93ea_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:623ece01f5d7af6844848879985ca0a9a50473cf3e3bb6f4923280948d9ff896_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:6246642e8ac76535613ae5758a0cbc1e408440de2ea2f8cc208c96d7266aac22_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8c32a894305bb7fc0ac7ed37872a8dbb09f50c387bd7eb9c955c6cd11c9cf4fe_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:927d84e4c8b52de401106d5aa10605eee94ce911a9d8e81e0c41d3b8beb7c63a_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e5bba2853add1a8dee9cd34a542b4baf82a50091a917c83b74ade4298528bd3e_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:0a7f042c6158dbc550e5f32ecbf5829ed925d2c9fdf30c1705ff4c3ce4bce077_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:729e49fb7cfe2bd21541b1e82ccbb77197285aa90486b0c1685379484a956dd9_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:95265ddc882b2548ed35ae247b283d0f25dce30a3904717396fe17c701d4eb81_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:42a9acbb0b0a6db326b51044c7e9c99f7a89b5861ac706eab1595b34146b77c4_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:55bea5ed24d5fda12c5a6ac34a908da2c471937fb2c934df1188b806ab56d96e_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:b8aa66884d5fdfc0383d7a6fdf34418b2c55a00f441fa41a374ca405d7b3f068_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:2adb884147e473b17086eb7cd5462fdd4ab18e6bdc81cd81940001be4a5b67c7_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:373275fba75136a5735ce6a98b94f6b44fc6122d278fdc347f8a8c4740ebcf33_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:8dd2654d1e078941de8b8cbd1d9aa3348ff8893c35edb5c513116129eae74207_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:060f753e5e57904fd0b3cea1f47f5a45a300ba40c3de448dce04fc4857200127_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ad2b63ce031af12d8c31eb40652e324ea9cc5891624c4e1683c00d2948825c0f_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ce71c4526b7cd5d2bebf771b38e6ac61a12c5dabe3d0f9963e27245944f9e6db_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:83e47a2dc1741bb81aa566f2b310ef0bd47a43792bcca823cdb8ee293c3c3e82_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ad7c57277851a741e0bc2536f564e86b59be8377366f4b1b7ea79aaa662dc6fa_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b565441374903dafa3ee00f015cabdf3c16b282d143fb1c9c91dcd126697d71d_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:172711e18b4289efdda02b662beeaa6941f7b41a533410871c9505b76f6a4481_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:7c15e7d6064a4f45e6aabb8ff309bd0244ff789ee392815d85f2321a90917929_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:b0d4ba54ba1e9bf8afe640c9c5b2c5eed807c22423a75e39702c033e41c93229_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:2468f097410bad3de5799b9d46801a04b4580a53d05498dcae37edf73c157826_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:8e8acf87581468fd98a97fe28438ea0146b3d8c2b12a322f5c63bf11b4588d81_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:f2ebd7e0fba97e74519ce5e05c1a5205e5a76d72ae88e8c83d4722f1f8c8950b_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:2a7393086842c64287c32d7cc99ba498c53ec164b3309df59277fb1bef6bbbad_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:358e601cd9e79a86df7bc735fc593a707ad4fc4e14ed8f39131297a26fb282c3_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:668c8f074fd4b5ee1cd55f3f4b139965b570b0344e8e3b248cc0fecc14a7e4a6_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:4953938e00bf4114fa18e0520ccf20611686da2372615187e5c4f2fdfbb01e06_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:c4915dcdfd96742aa5ba9ca38d0de9938ce9c85f6fffa867c35427829ee7462f_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-central-db-rhel8@sha256:f8fa778d169160543339202f870232b6b00a1d01347f4041565cae9acc910ea9_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:0ae622d315c3f3b23d76b7bc864c8b3d45d53db76a1fcc46d77be0c126bb93ea_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:623ece01f5d7af6844848879985ca0a9a50473cf3e3bb6f4923280948d9ff896_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-rhel8@sha256:6246642e8ac76535613ae5758a0cbc1e408440de2ea2f8cc208c96d7266aac22_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8c32a894305bb7fc0ac7ed37872a8dbb09f50c387bd7eb9c955c6cd11c9cf4fe_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:927d84e4c8b52de401106d5aa10605eee94ce911a9d8e81e0c41d3b8beb7c63a_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e5bba2853add1a8dee9cd34a542b4baf82a50091a917c83b74ade4298528bd3e_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:0a7f042c6158dbc550e5f32ecbf5829ed925d2c9fdf30c1705ff4c3ce4bce077_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:729e49fb7cfe2bd21541b1e82ccbb77197285aa90486b0c1685379484a956dd9_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-main-rhel8@sha256:95265ddc882b2548ed35ae247b283d0f25dce30a3904717396fe17c701d4eb81_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:42a9acbb0b0a6db326b51044c7e9c99f7a89b5861ac706eab1595b34146b77c4_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:55bea5ed24d5fda12c5a6ac34a908da2c471937fb2c934df1188b806ab56d96e_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-operator-bundle@sha256:b8aa66884d5fdfc0383d7a6fdf34418b2c55a00f441fa41a374ca405d7b3f068_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:2adb884147e473b17086eb7cd5462fdd4ab18e6bdc81cd81940001be4a5b67c7_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:373275fba75136a5735ce6a98b94f6b44fc6122d278fdc347f8a8c4740ebcf33_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-rhel8-operator@sha256:8dd2654d1e078941de8b8cbd1d9aa3348ff8893c35edb5c513116129eae74207_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:060f753e5e57904fd0b3cea1f47f5a45a300ba40c3de448dce04fc4857200127_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ad2b63ce031af12d8c31eb40652e324ea9cc5891624c4e1683c00d2948825c0f_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ce71c4526b7cd5d2bebf771b38e6ac61a12c5dabe3d0f9963e27245944f9e6db_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:83e47a2dc1741bb81aa566f2b310ef0bd47a43792bcca823cdb8ee293c3c3e82_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ad7c57277851a741e0bc2536f564e86b59be8377366f4b1b7ea79aaa662dc6fa_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b565441374903dafa3ee00f015cabdf3c16b282d143fb1c9c91dcd126697d71d_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:172711e18b4289efdda02b662beeaa6941f7b41a533410871c9505b76f6a4481_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:7c15e7d6064a4f45e6aabb8ff309bd0244ff789ee392815d85f2321a90917929_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:b0d4ba54ba1e9bf8afe640c9c5b2c5eed807c22423a75e39702c033e41c93229_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:2468f097410bad3de5799b9d46801a04b4580a53d05498dcae37edf73c157826_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:8e8acf87581468fd98a97fe28438ea0146b3d8c2b12a322f5c63bf11b4588d81_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-rhel8@sha256:f2ebd7e0fba97e74519ce5e05c1a5205e5a76d72ae88e8c83d4722f1f8c8950b_ppc64le",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:2a7393086842c64287c32d7cc99ba498c53ec164b3309df59277fb1bef6bbbad_amd64",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:358e601cd9e79a86df7bc735fc593a707ad4fc4e14ed8f39131297a26fb282c3_s390x",
            "8Base-RHACS-3.74:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:668c8f074fd4b5ee1cd55f3f4b139965b570b0344e8e3b248cc0fecc14a7e4a6_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2023-10-10T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)"
    }
  ]
}

cve-2023-44487

Vulnerability from cvelistv5

Published

2023-10-10 00:00

Modified

2024-08-19 07:48

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

References

▼	URL	Tags
	https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73
	https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
	https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
	https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
	https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
	https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/
	https://news.ycombinator.com/item?id=37831062
	https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
	https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack
	https://github.com/envoyproxy/envoy/pull/30055
	https://github.com/haproxy/haproxy/issues/2312
	https://github.com/eclipse/jetty.project/issues/10679
	https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
	https://github.com/nghttp2/nghttp2/pull/1961
	https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
	https://github.com/alibaba/tengine/issues/1872
	https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2
	https://news.ycombinator.com/item?id=37830987
	https://news.ycombinator.com/item?id=37830998
	https://github.com/caddyserver/caddy/issues/5877
	https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/
	https://github.com/bcdannyboy/CVE-2023-44487
	https://github.com/grpc/grpc-go/pull/6703
	https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244
	https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
	https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html
	https://my.f5.com/manage/s/article/K000137106
	https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/
	https://bugzilla.proxmox.com/show_bug.cgi?id=4988
	https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9
	https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected
	https://github.com/microsoft/CBL-Mariner/pull/6381
	https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
	https://github.com/facebook/proxygen/pull/466
	https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088
	https://github.com/micrictor/http2-rst-stream
	https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve
	https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/
	https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf
	https://github.com/h2o/h2o/pull/3291
	https://github.com/nodejs/node/pull/50121
	https://github.com/dotnet/announcements/issues/277
	https://github.com/golang/go/issues/63417
	https://github.com/advisories/GHSA-vx74-f528-fxqg
	https://github.com/apache/trafficserver/pull/10564
	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487
	https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14
	https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q
	https://www.openwall.com/lists/oss-security/2023/10/10/6
	https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487
	https://github.com/opensearch-project/data-prepper/issues/3474
	https://github.com/kubernetes/kubernetes/pull/121120
	https://github.com/oqtane/oqtane.framework/discussions/3367
	https://github.com/advisories/GHSA-xpw8-rcwv-8f8p
	https://netty.io/news/2023/10/10/4-1-100-Final.html
	https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
	https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/
	https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack
	https://news.ycombinator.com/item?id=37837043
	https://github.com/kazu-yamamoto/http2/issues/93
	https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html
	https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1
	https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113
	https://www.debian.org/security/2023/dsa-5522	vendor-advisory
	https://www.debian.org/security/2023/dsa-5521	vendor-advisory
	https://access.redhat.com/security/cve/cve-2023-44487
	https://github.com/ninenines/cowboy/issues/1615
	https://github.com/varnishcache/varnish-cache/issues/3996
	https://github.com/tempesta-tech/tempesta/issues/1986
	https://blog.vespa.ai/cve-2023-44487/
	https://github.com/etcd-io/etcd/issues/16740
	https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event
	https://istio.io/latest/news/security/istio-security-2023-004/
	https://github.com/junkurihara/rust-rpxy/issues/97
	https://bugzilla.suse.com/show_bug.cgi?id=1216123
	https://bugzilla.redhat.com/show_bug.cgi?id=2242803
	https://ubuntu.com/security/CVE-2023-44487
	https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125
	https://github.com/advisories/GHSA-qppj-fm5r-hxr3
	https://github.com/apache/httpd-site/pull/10
	https://github.com/projectcontour/contour/pull/5826
	https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632
	https://github.com/line/armeria/pull/5232
	https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/
	https://security.paloaltonetworks.com/CVE-2023-44487
	https://github.com/akka/akka-http/issues/4323
	https://github.com/openresty/openresty/issues/930
	https://github.com/apache/apisix/issues/10320
	https://github.com/Azure/AKS/issues/3947
	https://github.com/Kong/kong/discussions/11741
	https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487
	https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/
	https://github.com/caddyserver/caddy/releases/tag/v2.7.5
	https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html	mailing-list
	http://www.openwall.com/lists/oss-security/2023/10/13/4	mailing-list
	http://www.openwall.com/lists/oss-security/2023/10/13/9	mailing-list
	https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/
	https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/	vendor-advisory
	https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/
	https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html	mailing-list
	https://security.netapp.com/advisory/ntap-20231016-0001/
	https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html	mailing-list
	http://www.openwall.com/lists/oss-security/2023/10/18/4	mailing-list
	http://www.openwall.com/lists/oss-security/2023/10/18/8	mailing-list
	http://www.openwall.com/lists/oss-security/2023/10/19/6	mailing-list
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/	vendor-advisory
	http://www.openwall.com/lists/oss-security/2023/10/20/8	mailing-list
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html	mailing-list
	https://www.debian.org/security/2023/dsa-5540	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html	mailing-list
	https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html	mailing-list
	https://www.debian.org/security/2023/dsa-5549	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/	vendor-advisory
	https://www.debian.org/security/2023/dsa-5558	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html	mailing-list
	https://security.gentoo.org/glsa/202311-09	vendor-advisory
	https://www.debian.org/security/2023/dsa-5570	vendor-advisory
	https://security.netapp.com/advisory/ntap-20240426-0007/
	https://security.netapp.com/advisory/ntap-20240621-0006/
	https://security.netapp.com/advisory/ntap-20240621-0007/

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ietf:http:2.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "http",
            "vendor": "ietf",
            "versions": [
              {
                "status": "affected",
                "version": "2.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-44487",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-23T20:34:21.334116Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-10-10",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-44487"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-23T20:35:03.253Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-19T07:48:04.546Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://aws.amazon.com/security/security-bulletins/AWS-2023-011/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://news.ycombinator.com/item?id=37831062"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/pull/30055"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/haproxy/haproxy/issues/2312"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/eclipse/jetty.project/issues/10679"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/nghttp2/nghttp2/pull/1961"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/alibaba/tengine/issues/1872"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://news.ycombinator.com/item?id=37830987"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://news.ycombinator.com/item?id=37830998"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/caddyserver/caddy/issues/5877"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/bcdannyboy/CVE-2023-44487"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/grpc/grpc-go/pull/6703"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://my.f5.com/manage/s/article/K000137106"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.proxmox.com/show_bug.cgi?id=4988"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/microsoft/CBL-Mariner/pull/6381"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/facebook/proxygen/pull/466"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/micrictor/http2-rst-stream"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/h2o/h2o/pull/3291"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/nodejs/node/pull/50121"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/dotnet/announcements/issues/277"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/golang/go/issues/63417"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/advisories/GHSA-vx74-f528-fxqg"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/apache/trafficserver/pull/10564"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2023/10/10/6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/opensearch-project/data-prepper/issues/3474"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/kubernetes/kubernetes/pull/121120"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/oqtane/oqtane.framework/discussions/3367"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/advisories/GHSA-xpw8-rcwv-8f8p"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://netty.io/news/2023/10/10/4-1-100-Final.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://news.ycombinator.com/item?id=37837043"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/kazu-yamamoto/http2/issues/93"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113"
          },
          {
            "name": "DSA-5522",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5522"
          },
          {
            "name": "DSA-5521",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5521"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/cve-2023-44487"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ninenines/cowboy/issues/1615"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/varnishcache/varnish-cache/issues/3996"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/tempesta-tech/tempesta/issues/1986"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.vespa.ai/cve-2023-44487/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/etcd-io/etcd/issues/16740"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://istio.io/latest/news/security/istio-security-2023-004/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/junkurihara/rust-rpxy/issues/97"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1216123"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://ubuntu.com/security/CVE-2023-44487"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/advisories/GHSA-qppj-fm5r-hxr3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/apache/httpd-site/pull/10"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/projectcontour/contour/pull/5826"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/line/armeria/pull/5232"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2023-44487"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/akka/akka-http/issues/4323"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/openresty/openresty/issues/930"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/apache/apisix/issues/10320"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/Azure/AKS/issues/3947"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/Kong/kong/discussions/11741"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/caddyserver/caddy/releases/tag/v2.7.5"
          },
          {
            "name": "[debian-lts-announce] 20231013 [SECURITY] [DLA 3617-1] tomcat9 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html"
          },
          {
            "name": "[oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/10/13/4"
          },
          {
            "name": "[oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/10/13/9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html"
          },
          {
            "name": "FEDORA-2023-ed2642fd58",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/"
          },
          {
            "name": "[debian-lts-announce] 20231016 [SECURITY] [DLA 3621-1] nghttp2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231016-0001/"
          },
          {
            "name": "[debian-lts-announce] 20231016 [SECURITY] [DLA 3617-2] tomcat9 regression update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html"
          },
          {
            "name": "[oss-security] 20231018 Vulnerability in Jenkins",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/10/18/4"
          },
          {
            "name": "[oss-security] 20231018 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/10/18/8"
          },
          {
            "name": "[oss-security] 20231019 CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/10/19/6"
          },
          {
            "name": "FEDORA-2023-54fadada12",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/"
          },
          {
            "name": "FEDORA-2023-5ff7bf1dd8",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/"
          },
          {
            "name": "[oss-security] 20231020 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/10/20/8"
          },
          {
            "name": "FEDORA-2023-17efd3f2cd",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/"
          },
          {
            "name": "FEDORA-2023-d5030c983c",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/"
          },
          {
            "name": "FEDORA-2023-0259c3f26f",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/"
          },
          {
            "name": "FEDORA-2023-2a9214af5f",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/"
          },
          {
            "name": "FEDORA-2023-e9c04d81c1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/"
          },
          {
            "name": "FEDORA-2023-f66fc0f62a",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/"
          },
          {
            "name": "FEDORA-2023-4d2fd884ea",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/"
          },
          {
            "name": "FEDORA-2023-b2c50535cb",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/"
          },
          {
            "name": "FEDORA-2023-fe53e13b5b",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/"
          },
          {
            "name": "FEDORA-2023-4bf641255e",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/"
          },
          {
            "name": "[debian-lts-announce] 20231030 [SECURITY] [DLA 3641-1] jetty9 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html"
          },
          {
            "name": "DSA-5540",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5540"
          },
          {
            "name": "[debian-lts-announce] 20231031 [SECURITY] [DLA 3638-1] h2o security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715"
          },
          {
            "name": "FEDORA-2023-1caffb88af",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/"
          },
          {
            "name": "FEDORA-2023-3f70b8d406",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/"
          },
          {
            "name": "FEDORA-2023-7b52921cae",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/"
          },
          {
            "name": "FEDORA-2023-7934802344",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/"
          },
          {
            "name": "FEDORA-2023-dbe64661af",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/"
          },
          {
            "name": "FEDORA-2023-822aab0a5a",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/"
          },
          {
            "name": "[debian-lts-announce] 20231105 [SECURITY] [DLA 3645-1] trafficserver security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html"
          },
          {
            "name": "DSA-5549",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5549"
          },
          {
            "name": "FEDORA-2023-c0c6a91330",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/"
          },
          {
            "name": "FEDORA-2023-492b7be466",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/"
          },
          {
            "name": "DSA-5558",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5558"
          },
          {
            "name": "[debian-lts-announce] 20231119 [SECURITY] [DLA 3656-1] netty security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html"
          },
          {
            "name": "GLSA-202311-09",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202311-09"
          },
          {
            "name": "DSA-5570",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5570"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240426-0007/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0007/"
          },
          {
            "url": "https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:08:34.967324",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73"
        },
        {
          "url": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/"
        },
        {
          "url": "https://aws.amazon.com/security/security-bulletins/AWS-2023-011/"
        },
        {
          "url": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack"
        },
        {
          "url": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/"
        },
        {
          "url": "https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/"
        },
        {
          "url": "https://news.ycombinator.com/item?id=37831062"
        },
        {
          "url": "https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/"
        },
        {
          "url": "https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack"
        },
        {
          "url": "https://github.com/envoyproxy/envoy/pull/30055"
        },
        {
          "url": "https://github.com/haproxy/haproxy/issues/2312"
        },
        {
          "url": "https://github.com/eclipse/jetty.project/issues/10679"
        },
        {
          "url": "https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764"
        },
        {
          "url": "https://github.com/nghttp2/nghttp2/pull/1961"
        },
        {
          "url": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61"
        },
        {
          "url": "https://github.com/alibaba/tengine/issues/1872"
        },
        {
          "url": "https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2"
        },
        {
          "url": "https://news.ycombinator.com/item?id=37830987"
        },
        {
          "url": "https://news.ycombinator.com/item?id=37830998"
        },
        {
          "url": "https://github.com/caddyserver/caddy/issues/5877"
        },
        {
          "url": "https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/"
        },
        {
          "url": "https://github.com/bcdannyboy/CVE-2023-44487"
        },
        {
          "url": "https://github.com/grpc/grpc-go/pull/6703"
        },
        {
          "url": "https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244"
        },
        {
          "url": "https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0"
        },
        {
          "url": "https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html"
        },
        {
          "url": "https://my.f5.com/manage/s/article/K000137106"
        },
        {
          "url": "https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/"
        },
        {
          "url": "https://bugzilla.proxmox.com/show_bug.cgi?id=4988"
        },
        {
          "url": "https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9"
        },
        {
          "url": "https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected"
        },
        {
          "url": "https://github.com/microsoft/CBL-Mariner/pull/6381"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo"
        },
        {
          "url": "https://github.com/facebook/proxygen/pull/466"
        },
        {
          "url": "https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088"
        },
        {
          "url": "https://github.com/micrictor/http2-rst-stream"
        },
        {
          "url": "https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve"
        },
        {
          "url": "https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/"
        },
        {
          "url": "https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf"
        },
        {
          "url": "https://github.com/h2o/h2o/pull/3291"
        },
        {
          "url": "https://github.com/nodejs/node/pull/50121"
        },
        {
          "url": "https://github.com/dotnet/announcements/issues/277"
        },
        {
          "url": "https://github.com/golang/go/issues/63417"
        },
        {
          "url": "https://github.com/advisories/GHSA-vx74-f528-fxqg"
        },
        {
          "url": "https://github.com/apache/trafficserver/pull/10564"
        },
        {
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487"
        },
        {
          "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14"
        },
        {
          "url": "https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2023/10/10/6"
        },
        {
          "url": "https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487"
        },
        {
          "url": "https://github.com/opensearch-project/data-prepper/issues/3474"
        },
        {
          "url": "https://github.com/kubernetes/kubernetes/pull/121120"
        },
        {
          "url": "https://github.com/oqtane/oqtane.framework/discussions/3367"
        },
        {
          "url": "https://github.com/advisories/GHSA-xpw8-rcwv-8f8p"
        },
        {
          "url": "https://netty.io/news/2023/10/10/4-1-100-Final.html"
        },
        {
          "url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487"
        },
        {
          "url": "https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/"
        },
        {
          "url": "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack"
        },
        {
          "url": "https://news.ycombinator.com/item?id=37837043"
        },
        {
          "url": "https://github.com/kazu-yamamoto/http2/issues/93"
        },
        {
          "url": "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html"
        },
        {
          "url": "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1"
        },
        {
          "url": "https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113"
        },
        {
          "name": "DSA-5522",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5522"
        },
        {
          "name": "DSA-5521",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5521"
        },
        {
          "url": "https://access.redhat.com/security/cve/cve-2023-44487"
        },
        {
          "url": "https://github.com/ninenines/cowboy/issues/1615"
        },
        {
          "url": "https://github.com/varnishcache/varnish-cache/issues/3996"
        },
        {
          "url": "https://github.com/tempesta-tech/tempesta/issues/1986"
        },
        {
          "url": "https://blog.vespa.ai/cve-2023-44487/"
        },
        {
          "url": "https://github.com/etcd-io/etcd/issues/16740"
        },
        {
          "url": "https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event"
        },
        {
          "url": "https://istio.io/latest/news/security/istio-security-2023-004/"
        },
        {
          "url": "https://github.com/junkurihara/rust-rpxy/issues/97"
        },
        {
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1216123"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803"
        },
        {
          "url": "https://ubuntu.com/security/CVE-2023-44487"
        },
        {
          "url": "https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125"
        },
        {
          "url": "https://github.com/advisories/GHSA-qppj-fm5r-hxr3"
        },
        {
          "url": "https://github.com/apache/httpd-site/pull/10"
        },
        {
          "url": "https://github.com/projectcontour/contour/pull/5826"
        },
        {
          "url": "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632"
        },
        {
          "url": "https://github.com/line/armeria/pull/5232"
        },
        {
          "url": "https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/"
        },
        {
          "url": "https://security.paloaltonetworks.com/CVE-2023-44487"
        },
        {
          "url": "https://github.com/akka/akka-http/issues/4323"
        },
        {
          "url": "https://github.com/openresty/openresty/issues/930"
        },
        {
          "url": "https://github.com/apache/apisix/issues/10320"
        },
        {
          "url": "https://github.com/Azure/AKS/issues/3947"
        },
        {
          "url": "https://github.com/Kong/kong/discussions/11741"
        },
        {
          "url": "https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487"
        },
        {
          "url": "https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/"
        },
        {
          "url": "https://github.com/caddyserver/caddy/releases/tag/v2.7.5"
        },
        {
          "name": "[debian-lts-announce] 20231013 [SECURITY] [DLA 3617-1] tomcat9 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html"
        },
        {
          "name": "[oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/10/13/4"
        },
        {
          "name": "[oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/10/13/9"
        },
        {
          "url": "https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/"
        },
        {
          "url": "https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html"
        },
        {
          "name": "FEDORA-2023-ed2642fd58",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/"
        },
        {
          "url": "https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/"
        },
        {
          "name": "[debian-lts-announce] 20231016 [SECURITY] [DLA 3621-1] nghttp2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231016-0001/"
        },
        {
          "name": "[debian-lts-announce] 20231016 [SECURITY] [DLA 3617-2] tomcat9 regression update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html"
        },
        {
          "name": "[oss-security] 20231018 Vulnerability in Jenkins",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/10/18/4"
        },
        {
          "name": "[oss-security] 20231018 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/10/18/8"
        },
        {
          "name": "[oss-security] 20231019 CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/10/19/6"
        },
        {
          "name": "FEDORA-2023-54fadada12",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/"
        },
        {
          "name": "FEDORA-2023-5ff7bf1dd8",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/"
        },
        {
          "name": "[oss-security] 20231020 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2023/10/20/8"
        },
        {
          "name": "FEDORA-2023-17efd3f2cd",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/"
        },
        {
          "name": "FEDORA-2023-d5030c983c",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/"
        },
        {
          "name": "FEDORA-2023-0259c3f26f",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/"
        },
        {
          "name": "FEDORA-2023-2a9214af5f",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/"
        },
        {
          "name": "FEDORA-2023-e9c04d81c1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/"
        },
        {
          "name": "FEDORA-2023-f66fc0f62a",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/"
        },
        {
          "name": "FEDORA-2023-4d2fd884ea",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/"
        },
        {
          "name": "FEDORA-2023-b2c50535cb",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/"
        },
        {
          "name": "FEDORA-2023-fe53e13b5b",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/"
        },
        {
          "name": "FEDORA-2023-4bf641255e",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/"
        },
        {
          "name": "[debian-lts-announce] 20231030 [SECURITY] [DLA 3641-1] jetty9 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html"
        },
        {
          "name": "DSA-5540",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5540"
        },
        {
          "name": "[debian-lts-announce] 20231031 [SECURITY] [DLA 3638-1] h2o security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html"
        },
        {
          "url": "https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715"
        },
        {
          "name": "FEDORA-2023-1caffb88af",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/"
        },
        {
          "name": "FEDORA-2023-3f70b8d406",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/"
        },
        {
          "name": "FEDORA-2023-7b52921cae",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/"
        },
        {
          "name": "FEDORA-2023-7934802344",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/"
        },
        {
          "name": "FEDORA-2023-dbe64661af",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/"
        },
        {
          "name": "FEDORA-2023-822aab0a5a",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/"
        },
        {
          "name": "[debian-lts-announce] 20231105 [SECURITY] [DLA 3645-1] trafficserver security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html"
        },
        {
          "name": "DSA-5549",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5549"
        },
        {
          "name": "FEDORA-2023-c0c6a91330",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/"
        },
        {
          "name": "FEDORA-2023-492b7be466",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/"
        },
        {
          "name": "DSA-5558",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5558"
        },
        {
          "name": "[debian-lts-announce] 20231119 [SECURITY] [DLA 3656-1] netty security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html"
        },
        {
          "name": "GLSA-202311-09",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202311-09"
        },
        {
          "name": "DSA-5570",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5570"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240426-0007/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0007/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-44487",
    "datePublished": "2023-10-10T00:00:00",
    "dateReserved": "2023-09-29T00:00:00",
    "dateUpdated": "2024-08-19T07:48:04.546Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-39325

Vulnerability from cvelistv5

Published

2023-10-11 21:15

Modified

2024-08-02 18:02

Severity ?

Summary

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

References

▼	URL	Tags
	https://go.dev/issue/63417
	https://go.dev/cl/534215
	https://go.dev/cl/534235
	https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ
	https://pkg.go.dev/vuln/GO-2023-2102
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/
	https://security.netapp.com/advisory/ntap-20231110-0008/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/
	https://security.gentoo.org/glsa/202311-09
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST/

Impacted products

Vendor

Product

Version

▼

Go standard library

net/http

Version: 0 ≤
Version: 1.21.0-0 ≤

golang.org/x/net

golang.org/x/net/http2

Version: 0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:02:06.746Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/63417"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/534215"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/534235"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2023-2102"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231110-0008/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202311-09"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "http2serverConn.serve"
            },
            {
              "name": "http2serverConn.processHeaders"
            },
            {
              "name": "http2serverConn.upgradeRequest"
            },
            {
              "name": "http2serverConn.runHandler"
            },
            {
              "name": "ListenAndServe"
            },
            {
              "name": "ListenAndServeTLS"
            },
            {
              "name": "Serve"
            },
            {
              "name": "ServeTLS"
            },
            {
              "name": "Server.ListenAndServe"
            },
            {
              "name": "Server.ListenAndServeTLS"
            },
            {
              "name": "Server.Serve"
            },
            {
              "name": "Server.ServeTLS"
            },
            {
              "name": "http2Server.ServeConn"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.20.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.21.3",
              "status": "affected",
              "version": "1.21.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/net/http2",
          "product": "golang.org/x/net/http2",
          "programRoutines": [
            {
              "name": "serverConn.serve"
            },
            {
              "name": "serverConn.processHeaders"
            },
            {
              "name": "serverConn.upgradeRequest"
            },
            {
              "name": "serverConn.runHandler"
            },
            {
              "name": "Server.ServeConn"
            }
          ],
          "vendor": "golang.org/x/net",
          "versions": [
            {
              "lessThan": "0.17.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-11T21:15:02.727Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/63417"
        },
        {
          "url": "https://go.dev/cl/534215"
        },
        {
          "url": "https://go.dev/cl/534235"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2023-2102"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231110-0008/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/"
        },
        {
          "url": "https://security.gentoo.org/glsa/202311-09"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST/"
        }
      ],
      "title": "HTTP/2 rapid reset can cause excessive work in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2023-39325",
    "datePublished": "2023-10-11T21:15:02.727Z",
    "dateReserved": "2023-07-27T17:05:55.188Z",
    "dateUpdated": "2024-08-02T18:02:06.746Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

rhsa-2023_6084

Vulnerability from csaf_redhat

cve-2023-44487

Vulnerability from cvelistv5

cve-2023-39325

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature