CVE-2023-43622
Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
概要
Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern.
This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.
This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.
Users are recommended to upgrade to version 2.4.58, which fixes the issue.
影響パッケージ
Bitnami
apache
[{"type":"SEMVER","events":[{"introduced":"2.4.55"},{"fixed":"2.4.58"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2023-43622 apache2 修正版: 2.4.58-r0
- Debian DEBIAN-CVE-2023-43622 apache2 修正版: 2.4.59-1~deb11u1
参照URL
- advisory httpd.apache.org
- advisory security.netapp.com
- web nvd.nist.gov