cyber-dojo
flows
nginx-archived-at-1707630884
artifacts
6442cf22ccba72a98e68d772c38c2cfb2492e5a34ad4cf68f6f0e69694d5b00a
By signing up, you agree to the
Terms of Service.
For more information about Kosli’s privacy practices, see the Kosli’s
Privacy Policy.
We’ll occasionally send you account-related emails.
We’ll occasionally send you account-related emails.
nginx-archived-at-1707630884
Reverse proxy
cyberdojo/nginx:b1ff2f7
Non-compliant
Download Evidence Package
JSON
{
"created_at": 1697052914.6348288,
"fingerprint": "6442cf22ccba72a98e68d772c38c2cfb2492e5a34ad4cf68f6f0e69694d5b00a",
"filename": "cyberdojo/nginx:b1ff2f7",
"git_commit": "b1ff2f75f55fdf8733de82f22b529b6d9cac37fb",
"build_url": "https://github.com/cyber-dojo/nginx/actions/runs/6487175035",
"commit_url": "https://github.com/cyber-dojo/nginx/commit/b1ff2f75f55fdf8733de82f22b529b6d9cac37fb",
"evidence": {
"snyk-scan": {
"evidence_type": "snyk",
"is_compliant": false,
"build_url": "https://github.com/cyber-dojo/snyk_scans/actions/runs/6523191902",
"evidence_archive_fingerprint": "04119aab655585d5e1faf1e31923b6df4b972d220ef78edc54707c8cda47e84e",
"user_data": {},
"snyk_results": {
"applications": [
{
"dependencyCount": 0,
"displayTargetFile": "/usr/share/java",
"docker": {},
"filesystemPolicy": true,
"hasUnknownVersions": false,
"ignoreSettings": {
"adminOnly": false,
"disregardFilesystemIgnores": false,
"reasonRequired": false
},
"isPrivate": true,
"licensesPolicy": {
"orgLicenseRules": {
"AGPL-1.0": {
"instructions": "",
"licenseType": "AGPL-1.0",
"severity": "high"
},
"AGPL-3.0": {
"instructions": "",
"licenseType": "AGPL-3.0",
"severity": "high"
},
"Artistic-1.0": {
"instructions": "",
"licenseType": "Artistic-1.0",
"severity": "medium"
},
"Artistic-2.0": {
"instructions": "",
"licenseType": "Artistic-2.0",
"severity": "medium"
},
"CDDL-1.0": {
"instructions": "",
"licenseType": "CDDL-1.0",
"severity": "medium"
},
"CPOL-1.02": {
"instructions": "",
"licenseType": "CPOL-1.02",
"severity": "high"
},
"EPL-1.0": {
"instructions": "",
"licenseType": "EPL-1.0",
"severity": "medium"
},
"GPL-2.0": {
"instructions": "",
"licenseType": "GPL-2.0",
"severity": "high"
},
"GPL-3.0": {
"instructions": "",
"licenseType": "GPL-3.0",
"severity": "high"
},
"LGPL-2.0": {
"instructions": "",
"licenseType": "LGPL-2.0",
"severity": "medium"
},
"LGPL-2.1": {
"instructions": "",
"licenseType": "LGPL-2.1",
"severity": "medium"
},
"LGPL-3.0": {
"instructions": "",
"licenseType": "LGPL-3.0",
"severity": "medium"
},
"MPL-1.1": {
"instructions": "",
"licenseType": "MPL-1.1",
"severity": "medium"
},
"MPL-2.0": {
"instructions": "",
"licenseType": "MPL-2.0",
"severity": "medium"
},
"MS-RL": {
"instructions": "",
"licenseType": "MS-RL",
"severity": "medium"
},
"SimPL-2.0": {
"instructions": "",
"licenseType": "SimPL-2.0",
"severity": "high"
}
},
"severities": {}
},
"ok": true,
"org": "jonjagger",
"packageManager": "maven",
"path": "274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@sha256:6442cf22ccba72a98e68d772c38c2cfb2492e5a34ad4cf68f6f0e69694d5b00a/nginx:b1ff2f7@sha256:6442cf22ccba72a98e68d772c38c2cfb2492e5a34ad4cf68f6f0e69694d5b00a:/usr/share/java",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\n# ignores vulnerabilities until expiry date; change duration by modifying expiry date\nignore:\n SNYK-DEBIAN12-TIFF-5862859:\n - '*':\n reason: Waiting for Debian upgrade\n expires: 2023-11-10T19:30:13.235Z\n created: 2023-10-11T19:30:13.242Z\n source: cli\n SNYK-DEBIAN12-TIFF-5862863:\n - '*':\n reason: Waiting for Debian upgrade\n expires: 2023-11-10T19:30:34.260Z\n created: 2023-10-11T19:30:34.270Z\n source: cli\n SNYK-DEBIAN12-TIFF-5934984:\n - '*':\n reason: Waiting for Debian upgrade\n expires: 2023-11-10T19:30:47.863Z\n created: 2023-10-11T19:30:47.874Z\n source: cli\n SNYK-DEBIAN12-NGHTTP2-5953379:\n - '*':\n reason: Waiting for Debian upgrade\n expires: 2023-11-10T19:31:20.564Z\n created: 2023-10-11T19:31:20.581Z\n source: cli\npatch: {}\n",
"projectName": "274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@sha256:6442cf22ccba72a98e68d772c38c2cfb2492e5a34ad4cf68f6f0e69694d5b00a:/usr/share/java",
"severityThreshold": "medium",
"summary": "No medium or high or critical severity vulnerabilities",
"targetFile": "/usr/share/java",
"uniqueCount": 0,
"vulnerabilities": []
}
],
"dependencyCount": 149,
"docker": {},
"filesystemPolicy": true,
"filtered": {
"ignore": [
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H",
"cpes": [],
"creationTime": "2023-10-11T02:06:26.471182Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-10-14T01:11:01.801031Z",
"severity": "high"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-10-14T11:03:27.396232Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nghttp2` package and not the `nghttp2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.\n## Remediation\nThere is no fixed version for `Debian:12` `nghttp2`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-44487)\n- [cve@mitre.org](https://aws.amazon.com/security/security-bulletins/AWS-2023-011/)\n- [cve@mitre.org](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/)\n- [cve@mitre.org](https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/)\n- [cve@mitre.org](https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/)\n- [cve@mitre.org](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack)\n- [cve@mitre.org](https://news.ycombinator.com/item?id=37831062)\n- [cve@mitre.org](https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/)\n- [cve@mitre.org](https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack)\n- [cve@mitre.org](https://chaos.social/@icing/111210915918780532)\n- [cve@mitre.org](https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764)\n- [cve@mitre.org](https://github.com/alibaba/tengine/issues/1872)\n- [cve@mitre.org](https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2)\n- [cve@mitre.org](https://github.com/bcdannyboy/CVE-2023-44487)\n- [cve@mitre.org](https://github.com/caddyserver/caddy/issues/5877)\n- [cve@mitre.org](https://github.com/eclipse/jetty.project/issues/10679)\n- [cve@mitre.org](https://github.com/envoyproxy/envoy/pull/30055)\n- [cve@mitre.org](https://github.com/haproxy/haproxy/issues/2312)\n- [cve@mitre.org](https://github.com/hyperium/hyper/issues/3337)\n- [cve@mitre.org](https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61)\n- [cve@mitre.org](https://github.com/nghttp2/nghttp2/pull/1961)\n- [cve@mitre.org](https://news.ycombinator.com/item?id=37830987)\n- [cve@mitre.org](https://news.ycombinator.com/item?id=37830998)\n- [cve@mitre.org](https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/)\n- [cve@mitre.org](https://github.com/grpc/grpc-go/pull/6703)\n- [cve@mitre.org](https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244)\n- [cve@mitre.org](https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0)\n- [cve@mitre.org](https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html)\n- [cve@mitre.org](https://my.f5.com/manage/s/article/K000137106)\n- [cve@mitre.org](https://bugzilla.proxmox.com/show_bug.cgi?id=4988)\n- [cve@mitre.org](https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9)\n- [cve@mitre.org](https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/)\n- [cve@mitre.org](https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve)\n- [cve@mitre.org](https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088)\n- [cve@mitre.org](https://github.com/advisories/GHSA-vx74-f528-fxqg)\n- [cve@mitre.org](https://github.com/apache/trafficserver/pull/10564)\n- [cve@mitre.org](https://github.com/dotnet/announcements/issues/277)\n- [cve@mitre.org](https://github.com/facebook/proxygen/pull/466)\n- [cve@mitre.org](https://github.com/golang/go/issues/63417)\n- [cve@mitre.org](https://github.com/h2o/h2o/pull/3291)\n- [cve@mitre.org](https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf)\n- [cve@mitre.org](https://github.com/micrictor/http2-rst-stream)\n- [cve@mitre.org](https://github.com/microsoft/CBL-Mariner/pull/6381)\n- [cve@mitre.org](https://github.com/nodejs/node/pull/50121)\n- [cve@mitre.org](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo)\n- [cve@mitre.org](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487)\n- [cve@mitre.org](https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/)\n- [cve@mitre.org](https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q)\n- [cve@mitre.org](https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected)\n- [cve@mitre.org](https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14)\n- [cve@mitre.org](https://www.openwall.com/lists/oss-security/2023/10/10/6)\n- [cve@mitre.org](https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73)\n- [cve@mitre.org](https://github.com/advisories/GHSA-xpw8-rcwv-8f8p)\n- [cve@mitre.org](https://github.com/kubernetes/kubernetes/pull/121120)\n- [cve@mitre.org](https://github.com/opensearch-project/data-prepper/issues/3474)\n- [cve@mitre.org](https://github.com/oqtane/oqtane.framework/discussions/3367)\n- [cve@mitre.org](https://netty.io/news/2023/10/10/4-1-100-Final.html)\n- [cve@mitre.org](https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487)\n- [cve@mitre.org](https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack)\n- [cve@mitre.org](https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113)\n- [cve@mitre.org](https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1)\n- [cve@mitre.org](https://github.com/kazu-yamamoto/http2/issues/93)\n- [cve@mitre.org](https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html)\n- [cve@mitre.org](https://news.ycombinator.com/item?id=37837043)\n- [cve@mitre.org](https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487)\n- [cve@mitre.org](https://www.debian.org/security/2023/dsa-5521)\n- [cve@mitre.org](https://www.debian.org/security/2023/dsa-5522)\n- [cve@mitre.org](https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/)\n- [cve@mitre.org](https://access.redhat.com/security/cve/cve-2023-44487)\n- [cve@mitre.org](https://blog.vespa.ai/cve-2023-44487/)\n- [cve@mitre.org](https://bugzilla.redhat.com/show_bug.cgi?id=2242803)\n- [cve@mitre.org](https://bugzilla.suse.com/show_bug.cgi?id=1216123)\n- [cve@mitre.org](https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125)\n- [cve@mitre.org](https://github.com/advisories/GHSA-qppj-fm5r-hxr3)\n- [cve@mitre.org](https://github.com/etcd-io/etcd/issues/16740)\n- [cve@mitre.org](https://github.com/junkurihara/rust-rpxy/issues/97)\n- [cve@mitre.org](https://github.com/ninenines/cowboy/issues/1615)\n- [cve@mitre.org](https://github.com/tempesta-tech/tempesta/issues/1986)\n- [cve@mitre.org](https://github.com/varnishcache/varnish-cache/issues/3996)\n- [cve@mitre.org](https://istio.io/latest/news/security/istio-security-2023-004/)\n- [cve@mitre.org](https://ubuntu.com/security/CVE-2023-44487)\n- [cve@mitre.org](https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event)\n- [cve@mitre.org](https://github.com/apache/httpd-site/pull/10)\n- [cve@mitre.org](https://github.com/line/armeria/pull/5232)\n- [cve@mitre.org](https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632)\n- [cve@mitre.org](https://github.com/projectcontour/contour/pull/5826)\n- [cve@mitre.org](https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/)\n- [cve@mitre.org](https://github.com/Azure/AKS/issues/3947)\n- [cve@mitre.org](https://github.com/Kong/kong/discussions/11741)\n- [cve@mitre.org](https://github.com/akka/akka-http/issues/4323)\n- [cve@mitre.org](https://github.com/apache/apisix/issues/10320)\n- [cve@mitre.org](https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487)\n- [cve@mitre.org](https://github.com/openresty/openresty/issues/930)\n- [cve@mitre.org](https://security.paloaltonetworks.com/CVE-2023-44487)\n- [cve@mitre.org](https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/)\n- [cve@mitre.org](https://github.com/caddyserver/caddy/releases/tag/v2.7.5)\n- [cve@mitre.org](https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/10/13/4)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/10/13/9)\n- [cve@mitre.org](https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/)\n- [cve@mitre.org](https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html)\n- [CISA - Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n",
"disclosureTime": "2023-10-10T14:15:10.883000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.76715",
"probability": "0.00636"
},
"exploit": "High",
"filtered": {
"ignored": [
{
"created": "2023-10-11T19:31:20.581Z",
"expires": "2023-11-10T19:31:20.564Z",
"path": [
"*"
],
"reason": "Waiting for Debian upgrade",
"source": "cli"
}
]
},
"fixedIn": [],
"from": [
"docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@*",
"curl@7.88.1-10+deb12u4",
"curl/libcurl4@7.88.1-10+deb12u4",
"nghttp2/libnghttp2-14@1.52.0-1"
],
"id": "SNYK-DEBIAN12-NGHTTP2-5953379",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-44487"
],
"CWE": [
"CWE-400"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-10-14T13:10:42.753047Z",
"name": "nghttp2/libnghttp2-14",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "nghttp2",
"patches": [],
"publicationTime": "2023-10-11T01:07:39.545468Z",
"references": [
{
"title": "https://security-tracker.debian.org/tracker/CVE-2023-44487",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-44487"
},
{
"title": "https://aws.amazon.com/security/security-bulletins/AWS-2023-011/",
"url": "https://aws.amazon.com/security/security-bulletins/AWS-2023-011/"
},
{
"title": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/",
"url": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/"
},
{
"title": "https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/",
"url": "https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/"
},
{
"title": "https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/",
"url": "https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/"
},
{
"title": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack",
"url": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack"
},
{
"title": "https://news.ycombinator.com/item?id=37831062",
"url": "https://news.ycombinator.com/item?id=37831062"
},
{
"title": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/",
"url": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/"
},
{
"title": "https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack",
"url": "https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack"
},
{
"title": "https://chaos.social/@icing/111210915918780532",
"url": "https://chaos.social/@icing/111210915918780532"
},
{
"title": "https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764",
"url": "https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764"
},
{
"title": "https://github.com/alibaba/tengine/issues/1872",
"url": "https://github.com/alibaba/tengine/issues/1872"
},
{
"title": "https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2",
"url": "https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2"
},
{
"title": "https://github.com/bcdannyboy/CVE-2023-44487",
"url": "https://github.com/bcdannyboy/CVE-2023-44487"
},
{
"title": "https://github.com/caddyserver/caddy/issues/5877",
"url": "https://github.com/caddyserver/caddy/issues/5877"
},
{
"title": "https://github.com/eclipse/jetty.project/issues/10679",
"url": "https://github.com/eclipse/jetty.project/issues/10679"
},
{
"title": "https://github.com/envoyproxy/envoy/pull/30055",
"url": "https://github.com/envoyproxy/envoy/pull/30055"
},
{
"title": "https://github.com/haproxy/haproxy/issues/2312",
"url": "https://github.com/haproxy/haproxy/issues/2312"
},
{
"title": "https://github.com/hyperium/hyper/issues/3337",
"url": "https://github.com/hyperium/hyper/issues/3337"
},
{
"title": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
"url": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61"
},
{
"title": "https://github.com/nghttp2/nghttp2/pull/1961",
"url": "https://github.com/nghttp2/nghttp2/pull/1961"
},
{
"title": "https://news.ycombinator.com/item?id=37830987",
"url": "https://news.ycombinator.com/item?id=37830987"
},
{
"title": "https://news.ycombinator.com/item?id=37830998",
"url": "https://news.ycombinator.com/item?id=37830998"
},
{
"title": "https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/",
"url": "https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/"
},
{
"title": "https://github.com/grpc/grpc-go/pull/6703",
"url": "https://github.com/grpc/grpc-go/pull/6703"
},
{
"title": "https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1%23L239-L244",
"url": "https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1%23L239-L244"
},
{
"title": "https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0",
"url": "https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0"
},
{
"title": "https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html",
"url": "https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html"
},
{
"title": "https://my.f5.com/manage/s/article/K000137106",
"url": "https://my.f5.com/manage/s/article/K000137106"
},
{
"title": "https://bugzilla.proxmox.com/show_bug.cgi?id=4988",
"url": "https://bugzilla.proxmox.com/show_bug.cgi?id=4988"
},
{
"title": "https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9",
"url": "https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9"
},
{
"title": "https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/",
"url": "https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/"
},
{
"title": "https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve",
"url": "https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve"
},
{
"title": "https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088",
"url": "https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088"
},
{
"title": "https://github.com/advisories/GHSA-vx74-f528-fxqg",
"url": "https://github.com/advisories/GHSA-vx74-f528-fxqg"
},
{
"title": "https://github.com/apache/trafficserver/pull/10564",
"url": "https://github.com/apache/trafficserver/pull/10564"
},
{
"title": "https://github.com/dotnet/announcements/issues/277",
"url": "https://github.com/dotnet/announcements/issues/277"
},
{
"title": "https://github.com/facebook/proxygen/pull/466",
"url": "https://github.com/facebook/proxygen/pull/466"
},
{
"title": "https://github.com/golang/go/issues/63417",
"url": "https://github.com/golang/go/issues/63417"
},
{
"title": "https://github.com/h2o/h2o/pull/3291",
"url": "https://github.com/h2o/h2o/pull/3291"
},
{
"title": "https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf",
"url": "https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf"
},
{
"title": "https://github.com/micrictor/http2-rst-stream",
"url": "https://github.com/micrictor/http2-rst-stream"
},
{
"title": "https://github.com/microsoft/CBL-Mariner/pull/6381",
"url": "https://github.com/microsoft/CBL-Mariner/pull/6381"
},
{
"title": "https://github.com/nodejs/node/pull/50121",
"url": "https://github.com/nodejs/node/pull/50121"
},
{
"title": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo",
"url": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo"
},
{
"title": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487"
},
{
"title": "https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/",
"url": "https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/"
},
{
"title": "https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q",
"url": "https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q"
},
{
"title": "https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected",
"url": "https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected"
},
{
"title": "https://tomcat.apache.org/security-10.html%23Fixed_in_Apache_Tomcat_10.1.14",
"url": "https://tomcat.apache.org/security-10.html%23Fixed_in_Apache_Tomcat_10.1.14"
},
{
"title": "https://www.openwall.com/lists/oss-security/2023/10/10/6",
"url": "https://www.openwall.com/lists/oss-security/2023/10/10/6"
},
{
"title": "https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1%23L73",
"url": "https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1%23L73"
},
{
"title": "https://github.com/advisories/GHSA-xpw8-rcwv-8f8p",
"url": "https://github.com/advisories/GHSA-xpw8-rcwv-8f8p"
},
{
"title": "https://github.com/kubernetes/kubernetes/pull/121120",
"url": "https://github.com/kubernetes/kubernetes/pull/121120"
},
{
"title": "https://github.com/opensearch-project/data-prepper/issues/3474",
"url": "https://github.com/opensearch-project/data-prepper/issues/3474"
},
{
"title": "https://github.com/oqtane/oqtane.framework/discussions/3367",
"url": "https://github.com/oqtane/oqtane.framework/discussions/3367"
},
{
"title": "https://netty.io/news/2023/10/10/4-1-100-Final.html",
"url": "https://netty.io/news/2023/10/10/4-1-100-Final.html"
},
{
"title": "https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487",
"url": "https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487"
},
{
"title": "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack",
"url": "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack"
},
{
"title": "https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c%23L1101-L1113",
"url": "https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c%23L1101-L1113"
},
{
"title": "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1",
"url": "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1"
},
{
"title": "https://github.com/kazu-yamamoto/http2/issues/93",
"url": "https://github.com/kazu-yamamoto/http2/issues/93"
},
{
"title": "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html",
"url": "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html"
},
{
"title": "https://news.ycombinator.com/item?id=37837043",
"url": "https://news.ycombinator.com/item?id=37837043"
},
{
"title": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
"url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487"
},
{
"title": "https://www.debian.org/security/2023/dsa-5521",
"url": "https://www.debian.org/security/2023/dsa-5521"
},
{
"title": "https://www.debian.org/security/2023/dsa-5522",
"url": "https://www.debian.org/security/2023/dsa-5522"
},
{
"title": "https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/",
"url": "https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/"
},
{
"title": "https://access.redhat.com/security/cve/cve-2023-44487",
"url": "https://access.redhat.com/security/cve/cve-2023-44487"
},
{
"title": "https://blog.vespa.ai/cve-2023-44487/",
"url": "https://blog.vespa.ai/cve-2023-44487/"
},
{
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803"
},
{
"title": "https://bugzilla.suse.com/show_bug.cgi?id=1216123",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1216123"
},
{
"title": "https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125",
"url": "https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125"
},
{
"title": "https://github.com/advisories/GHSA-qppj-fm5r-hxr3",
"url": "https://github.com/advisories/GHSA-qppj-fm5r-hxr3"
},
{
"title": "https://github.com/etcd-io/etcd/issues/16740",
"url": "https://github.com/etcd-io/etcd/issues/16740"
},
{
"title": "https://github.com/junkurihara/rust-rpxy/issues/97",
"url": "https://github.com/junkurihara/rust-rpxy/issues/97"
},
{
"title": "https://github.com/ninenines/cowboy/issues/1615",
"url": "https://github.com/ninenines/cowboy/issues/1615"
},
{
"title": "https://github.com/tempesta-tech/tempesta/issues/1986",
"url": "https://github.com/tempesta-tech/tempesta/issues/1986"
},
{
"title": "https://github.com/varnishcache/varnish-cache/issues/3996",
"url": "https://github.com/varnishcache/varnish-cache/issues/3996"
},
{
"title": "https://istio.io/latest/news/security/istio-security-2023-004/",
"url": "https://istio.io/latest/news/security/istio-security-2023-004/"
},
{
"title": "https://ubuntu.com/security/CVE-2023-44487",
"url": "https://ubuntu.com/security/CVE-2023-44487"
},
{
"title": "https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event",
"url": "https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event"
},
{
"title": "https://github.com/apache/httpd-site/pull/10",
"url": "https://github.com/apache/httpd-site/pull/10"
},
{
"title": "https://github.com/line/armeria/pull/5232",
"url": "https://github.com/line/armeria/pull/5232"
},
{
"title": "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632",
"url": "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632"
},
{
"title": "https://github.com/projectcontour/contour/pull/5826",
"url": "https://github.com/projectcontour/contour/pull/5826"
},
{
"title": "https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/",
"url": "https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/"
},
{
"title": "https://github.com/Azure/AKS/issues/3947",
"url": "https://github.com/Azure/AKS/issues/3947"
},
{
"title": "https://github.com/Kong/kong/discussions/11741",
"url": "https://github.com/Kong/kong/discussions/11741"
},
{
"title": "https://github.com/akka/akka-http/issues/4323",
"url": "https://github.com/akka/akka-http/issues/4323"
},
{
"title": "https://github.com/apache/apisix/issues/10320",
"url": "https://github.com/apache/apisix/issues/10320"
},
{
"title": "https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487",
"url": "https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487"
},
{
"title": "https://github.com/openresty/openresty/issues/930",
"url": "https://github.com/openresty/openresty/issues/930"
},
{
"title": "https://security.paloaltonetworks.com/CVE-2023-44487",
"url": "https://security.paloaltonetworks.com/CVE-2023-44487"
},
{
"title": "https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/",
"url": "https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/"
},
{
"title": "https://github.com/caddyserver/caddy/releases/tag/v2.7.5",
"url": "https://github.com/caddyserver/caddy/releases/tag/v2.7.5"
},
{
"title": "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html",
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html"
},
{
"title": "http://www.openwall.com/lists/oss-security/2023/10/13/4",
"url": "http://www.openwall.com/lists/oss-security/2023/10/13/4"
},
{
"title": "http://www.openwall.com/lists/oss-security/2023/10/13/9",
"url": "http://www.openwall.com/lists/oss-security/2023/10/13/9"
},
{
"title": "https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/",
"url": "https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/"
},
{
"title": "https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html",
"url": "https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html"
},
{
"title": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"relativeImportance": "not yet assigned",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "high",
"severityWithCritical": "high",
"socialTrendAlert": true,
"title": "Resource Exhaustion",
"upgradePath": [],
"version": "1.52.0-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-08-29T02:14:12.065902Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-10-11T01:10:52.532167Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nLibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-40745)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-40745)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2235265)\n",
"disclosureTime": "2023-10-05T19:15:11.260000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.39290",
"probability": "0.00094"
},
"exploit": "Not Defined",
"filtered": {
"ignored": [
{
"created": "2023-10-11T19:30:13.242Z",
"expires": "2023-11-10T19:30:13.235Z",
"path": [
"*"
],
"reason": "Waiting for Debian upgrade",
"source": "cli"
}
]
},
"fixedIn": [],
"from": [
"docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@*",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-5862859",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-40745"
],
"CWE": [
"CWE-190"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-10-11T01:10:52.604444Z",
"name": "tiff/libtiff6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2023-08-29T02:14:12.010192Z",
"references": [
{
"title": "https://security-tracker.debian.org/tracker/CVE-2023-40745",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-40745"
},
{
"title": "https://access.redhat.com/security/cve/CVE-2023-40745",
"url": "https://access.redhat.com/security/cve/CVE-2023-40745"
},
{
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2235265",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2235265"
}
],
"relativeImportance": "not yet assigned",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "medium",
"severityWithCritical": "medium",
"socialTrendAlert": false,
"title": "Integer Overflow or Wraparound",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-08-29T02:15:15.690236Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-10-11T01:10:52.697590Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-41175)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-41175)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2235264)\n",
"disclosureTime": "2023-10-05T19:15:11.340000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.39290",
"probability": "0.00094"
},
"exploit": "Not Defined",
"filtered": {
"ignored": [
{
"created": "2023-10-11T19:30:34.270Z",
"expires": "2023-11-10T19:30:34.260Z",
"path": [
"*"
],
"reason": "Waiting for Debian upgrade",
"source": "cli"
}
]
},
"fixedIn": [],
"from": [
"docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@*",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-5862863",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-41175"
],
"CWE": [
"CWE-190"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-10-11T01:10:52.784935Z",
"name": "tiff/libtiff6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2023-08-29T02:14:21.842855Z",
"references": [
{
"title": "https://security-tracker.debian.org/tracker/CVE-2023-41175",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-41175"
},
{
"title": "https://access.redhat.com/security/cve/CVE-2023-41175",
"url": "https://access.redhat.com/security/cve/CVE-2023-41175"
},
{
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2235264",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2235264"
}
],
"relativeImportance": "not yet assigned",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "medium",
"severityWithCritical": "medium",
"socialTrendAlert": false,
"title": "Integer Overflow or Wraparound",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-10-05T14:53:13.833743Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-07-12T13:48:20.082991Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-10-11T01:10:46.904290Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes this memory leak issue, resulting an application crash, eventually leading to a denial of service.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3576)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-3576)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2219340)\n",
"disclosureTime": "2023-10-04T19:15:10.340000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07179",
"probability": "0.00043"
},
"exploit": "Not Defined",
"filtered": {
"ignored": [
{
"created": "2023-10-11T19:30:47.874Z",
"expires": "2023-11-10T19:30:47.863Z",
"path": [
"*"
],
"reason": "Waiting for Debian upgrade",
"source": "cli"
}
]
},
"fixedIn": [],
"from": [
"docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@*",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-5934984",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3576"
],
"CWE": [
"CWE-401"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-10-11T01:10:47.010194Z",
"name": "tiff/libtiff6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2023-10-05T14:51:44.129440Z",
"references": [
{
"title": "https://security-tracker.debian.org/tracker/CVE-2023-3576",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3576"
},
{
"title": "https://access.redhat.com/security/cve/CVE-2023-3576",
"url": "https://access.redhat.com/security/cve/CVE-2023-3576"
},
{
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2219340",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219340"
}
],
"relativeImportance": "not yet assigned",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "medium",
"severityWithCritical": "medium",
"socialTrendAlert": false,
"title": "Memory Leak",
"upgradePath": [],
"version": "4.5.0-6"
}
],
"patch": []
},
"hasUnknownVersions": false,
"ignoreSettings": {
"adminOnly": false,
"disregardFilesystemIgnores": false,
"reasonRequired": false
},
"isPrivate": true,
"licensesPolicy": {
"orgLicenseRules": {
"AGPL-1.0": {
"instructions": "",
"licenseType": "AGPL-1.0",
"severity": "high"
},
"AGPL-3.0": {
"instructions": "",
"licenseType": "AGPL-3.0",
"severity": "high"
},
"Artistic-1.0": {
"instructions": "",
"licenseType": "Artistic-1.0",
"severity": "medium"
},
"Artistic-2.0": {
"instructions": "",
"licenseType": "Artistic-2.0",
"severity": "medium"
},
"CDDL-1.0": {
"instructions": "",
"licenseType": "CDDL-1.0",
"severity": "medium"
},
"CPOL-1.02": {
"instructions": "",
"licenseType": "CPOL-1.02",
"severity": "high"
},
"EPL-1.0": {
"instructions": "",
"licenseType": "EPL-1.0",
"severity": "medium"
},
"GPL-2.0": {
"instructions": "",
"licenseType": "GPL-2.0",
"severity": "high"
},
"GPL-3.0": {
"instructions": "",
"licenseType": "GPL-3.0",
"severity": "high"
},
"LGPL-2.0": {
"instructions": "",
"licenseType": "LGPL-2.0",
"severity": "medium"
},
"LGPL-2.1": {
"instructions": "",
"licenseType": "LGPL-2.1",
"severity": "medium"
},
"LGPL-3.0": {
"instructions": "",
"licenseType": "LGPL-3.0",
"severity": "medium"
},
"MPL-1.1": {
"instructions": "",
"licenseType": "MPL-1.1",
"severity": "medium"
},
"MPL-2.0": {
"instructions": "",
"licenseType": "MPL-2.0",
"severity": "medium"
},
"MS-RL": {
"instructions": "",
"licenseType": "MS-RL",
"severity": "medium"
},
"SimPL-2.0": {
"instructions": "",
"licenseType": "SimPL-2.0",
"severity": "high"
}
},
"severities": {}
},
"ok": false,
"org": "jonjagger",
"packageManager": "deb",
"path": "274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@sha256:6442cf22ccba72a98e68d772c38c2cfb2492e5a34ad4cf68f6f0e69694d5b00a/nginx:b1ff2f7",
"platform": "linux/amd64",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\n# ignores vulnerabilities until expiry date; change duration by modifying expiry date\nignore:\n SNYK-DEBIAN12-TIFF-5862859:\n - '*':\n reason: Waiting for Debian upgrade\n expires: 2023-11-10T19:30:13.235Z\n created: 2023-10-11T19:30:13.242Z\n source: cli\n SNYK-DEBIAN12-TIFF-5862863:\n - '*':\n reason: Waiting for Debian upgrade\n expires: 2023-11-10T19:30:34.260Z\n created: 2023-10-11T19:30:34.270Z\n source: cli\n SNYK-DEBIAN12-TIFF-5934984:\n - '*':\n reason: Waiting for Debian upgrade\n expires: 2023-11-10T19:30:47.863Z\n created: 2023-10-11T19:30:47.874Z\n source: cli\n SNYK-DEBIAN12-NGHTTP2-5953379:\n - '*':\n reason: Waiting for Debian upgrade\n expires: 2023-11-10T19:31:20.564Z\n created: 2023-10-11T19:31:20.581Z\n source: cli\npatch: {}\n",
"projectName": "docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7",
"severityThreshold": "medium",
"summary": "6 medium or high or critical severity vulnerable dependency paths",
"uniqueCount": 2,
"vulnerabilities": [
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cpes": [],
"creationTime": "2023-10-04T01:39:47.824771Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"modificationTime": "2023-10-05T11:03:51.864684Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 7.8,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2023-10-14T01:10:44.765946Z",
"severity": "high"
}
],
"cvssScore": 7.8,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libxpm` package and not the `libxpm` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges.\n## Remediation\nThere is no fixed version for `Debian:12` `libxpm`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-43787)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-43787)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2242254)\n",
"disclosureTime": "2023-10-10T13:15:22.083000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07816",
"probability": "0.00043"
},
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@*",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libxpm/libxpm4@1:3.5.12-1.1+deb12u1"
],
"id": "SNYK-DEBIAN12-LIBXPM-5927176",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-43787"
],
"CWE": [
"CWE-190"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-10-14T01:10:44.795752Z",
"name": "libxpm/libxpm4",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "libxpm",
"patches": [],
"publicationTime": "2023-10-04T01:35:08.049153Z",
"references": [
{
"title": "https://security-tracker.debian.org/tracker/CVE-2023-43787",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-43787"
},
{
"title": "https://access.redhat.com/security/cve/CVE-2023-43787",
"url": "https://access.redhat.com/security/cve/CVE-2023-43787"
},
{
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2242254",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242254"
}
],
"relativeImportance": "not yet assigned",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "high",
"severityWithCritical": "high",
"socialTrendAlert": false,
"title": "Integer Overflow or Wraparound",
"upgradePath": [],
"version": "1:3.5.12-1.1+deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-10-04T01:39:54.574701Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-10-05T11:03:53.170531Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-10-14T01:10:44.669482Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libxpm` package and not the `libxpm` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.\n## Remediation\nThere is no fixed version for `Debian:12` `libxpm`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-43786)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-43786)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2242253)\n",
"disclosureTime": "2023-10-10T13:15:22.023000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.05682",
"probability": "0.00042"
},
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@*",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libxpm/libxpm4@1:3.5.12-1.1+deb12u1"
],
"id": "SNYK-DEBIAN12-LIBXPM-5927179",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-43786"
],
"CWE": [
"CWE-835"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-10-14T01:10:44.728351Z",
"name": "libxpm/libxpm4",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "libxpm",
"patches": [],
"publicationTime": "2023-10-04T01:36:23.157139Z",
"references": [
{
"title": "https://security-tracker.debian.org/tracker/CVE-2023-43786",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-43786"
},
{
"title": "https://access.redhat.com/security/cve/CVE-2023-43786",
"url": "https://access.redhat.com/security/cve/CVE-2023-43786"
},
{
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2242253",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242253"
}
],
"relativeImportance": "not yet assigned",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "medium",
"severityWithCritical": "medium",
"socialTrendAlert": false,
"title": "Loop with Unreachable Exit Condition ('Infinite Loop')",
"upgradePath": [],
"version": "1:3.5.12-1.1+deb12u1"
}
]
},
"created_at": 1697361506.7932181,
"has_audit_package": true
}
},
"git_commit_info": {
"sha1": "b1ff2f75f55fdf8733de82f22b529b6d9cac37fb",
"message": "Snyk: Add new vulnerabilities to .snyk file until upgrades are available",
"author": "Faye <faye@kosli.com>",
"timestamp": 1697052828,
"branch": "main"
},
"repo_url": "https://github.com/cyber-dojo/nginx",
"template": [
"artifact",
"snyk-scan"
],
"last_modified_at": 1697361506.7932181,
"deployments": [
74,
73
],
"state": "NON-COMPLIANT",
"html_url": "https://app.kosli.com/cyber-dojo/flows/nginx-archived-at-1707630884/artifacts/6442cf22ccba72a98e68d772c38c2cfb2492e5a34ad4cf68f6f0e69694d5b00a",
"api_url": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/nginx-archived-at-1707630884/fingerprint/6442cf22ccba72a98e68d772c38c2cfb2492e5a34ad4cf68f6f0e69694d5b00a"
}
Artifact Information |
|
| Name | cyberdojo/nginx:b1ff2f7 |
| Fingerprint | 6442cf22ccba72a98e68d772c38c2cfb2492e5a34ad4cf68f6f0e69694d5b00a |
| Git commit |
b1ff2f7
Faye <faye@kosli.com> (main)
1697052828.0 • 7 months ago
Snyk: Add new vulnerabilities to .snyk file until upgrades are available
|
| CI Build | https://github.com/cyber-dojo/nginx/actions/runs/6487175035 |
| Running | - |
| Exited | aws-beta#1892 aws-prod#1162 |
| Last modified | 1697361506.7932181 • 7 months ago |
Approvals
| None |
Evidence
Evidence for 'snyk-scan'
{ "evidence_type": "snyk", "name": "snyk-scan", "is_compliant": false, "build_url": "https://github.com/cyber-dojo/snyk_scans/actions/runs/6523191902", "evidence_archive_fingerprint": "04119aab655585d5e1faf1e31923b6df4b972d220ef78edc54707c8cda47e84e", "user_data": {}, "snyk_results": { "applications": [ { "dependencyCount": 0, "displayTargetFile": "/usr/share/java", "docker": {}, "filesystemPolicy": true, "hasUnknownVersions": false, "ignoreSettings": { "adminOnly": false, "disregardFilesystemIgnores": false, "reasonRequired": false }, "isPrivate": true, "licensesPolicy": { "orgLicenseRules": { "AGPL-1.0": { "instructions": "", "licenseType": "AGPL-1.0", "severity": "high" }, "AGPL-3.0": { "instructions": "", "licenseType": "AGPL-3.0", "severity": "high" }, "Artistic-1.0": { "instructions": "", "licenseType": "Artistic-1.0", "severity": "medium" }, "Artistic-2.0": { "instructions": "", "licenseType": "Artistic-2.0", "severity": "medium" }, "CDDL-1.0": { "instructions": "", "licenseType": "CDDL-1.0", "severity": "medium" }, "CPOL-1.02": { "instructions": "", "licenseType": "CPOL-1.02", "severity": "high" }, "EPL-1.0": { "instructions": "", "licenseType": "EPL-1.0", "severity": "medium" }, "GPL-2.0": { "instructions": "", "licenseType": "GPL-2.0", "severity": "high" }, "GPL-3.0": { "instructions": "", "licenseType": "GPL-3.0", "severity": "high" }, "LGPL-2.0": { "instructions": "", "licenseType": "LGPL-2.0", "severity": "medium" }, "LGPL-2.1": { "instructions": "", "licenseType": "LGPL-2.1", "severity": "medium" }, "LGPL-3.0": { "instructions": "", "licenseType": "LGPL-3.0", "severity": "medium" }, "MPL-1.1": { "instructions": "", "licenseType": "MPL-1.1", "severity": "medium" }, "MPL-2.0": { "instructions": "", "licenseType": "MPL-2.0", "severity": "medium" }, "MS-RL": { "instructions": "", "licenseType": "MS-RL", "severity": "medium" }, "SimPL-2.0": { "instructions": "", "licenseType": "SimPL-2.0", "severity": "high" } }, "severities": {} }, "ok": true, "org": "jonjagger", "packageManager": "maven", "path": "274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@sha256:6442cf22ccba72a98e68d772c38c2cfb2492e5a34ad4cf68f6f0e69694d5b00a/nginx:b1ff2f7@sha256:6442cf22ccba72a98e68d772c38c2cfb2492e5a34ad4cf68f6f0e69694d5b00a:/usr/share/java", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\n# ignores vulnerabilities until expiry date; change duration by modifying expiry date\nignore:\n SNYK-DEBIAN12-TIFF-5862859:\n - '*':\n reason: Waiting for Debian upgrade\n expires: 2023-11-10T19:30:13.235Z\n created: 2023-10-11T19:30:13.242Z\n source: cli\n SNYK-DEBIAN12-TIFF-5862863:\n - '*':\n reason: Waiting for Debian upgrade\n expires: 2023-11-10T19:30:34.260Z\n created: 2023-10-11T19:30:34.270Z\n source: cli\n SNYK-DEBIAN12-TIFF-5934984:\n - '*':\n reason: Waiting for Debian upgrade\n expires: 2023-11-10T19:30:47.863Z\n created: 2023-10-11T19:30:47.874Z\n source: cli\n SNYK-DEBIAN12-NGHTTP2-5953379:\n - '*':\n reason: Waiting for Debian upgrade\n expires: 2023-11-10T19:31:20.564Z\n created: 2023-10-11T19:31:20.581Z\n source: cli\npatch: {}\n", "projectName": "274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@sha256:6442cf22ccba72a98e68d772c38c2cfb2492e5a34ad4cf68f6f0e69694d5b00a:/usr/share/java", "severityThreshold": "medium", "summary": "No medium or high or critical severity vulnerabilities", "targetFile": "/usr/share/java", "uniqueCount": 0, "vulnerabilities": [] } ], "dependencyCount": 149, "docker": {}, "filesystemPolicy": true, "filtered": { "ignore": [ { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H", "cpes": [], "creationTime": "2023-10-11T02:06:26.471182Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-10-14T01:11:01.801031Z", "severity": "high" }, { "assigner": "SUSE", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-10-14T11:03:27.396232Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nghttp2` package and not the `nghttp2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.\n## Remediation\nThere is no fixed version for `Debian:12` `nghttp2`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-44487)\n- [cve@mitre.org](https://aws.amazon.com/security/security-bulletins/AWS-2023-011/)\n- [cve@mitre.org](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/)\n- [cve@mitre.org](https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/)\n- [cve@mitre.org](https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/)\n- [cve@mitre.org](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack)\n- [cve@mitre.org](https://news.ycombinator.com/item?id=37831062)\n- [cve@mitre.org](https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/)\n- [cve@mitre.org](https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack)\n- [cve@mitre.org](https://chaos.social/@icing/111210915918780532)\n- [cve@mitre.org](https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764)\n- [cve@mitre.org](https://github.com/alibaba/tengine/issues/1872)\n- [cve@mitre.org](https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2)\n- [cve@mitre.org](https://github.com/bcdannyboy/CVE-2023-44487)\n- [cve@mitre.org](https://github.com/caddyserver/caddy/issues/5877)\n- [cve@mitre.org](https://github.com/eclipse/jetty.project/issues/10679)\n- [cve@mitre.org](https://github.com/envoyproxy/envoy/pull/30055)\n- [cve@mitre.org](https://github.com/haproxy/haproxy/issues/2312)\n- [cve@mitre.org](https://github.com/hyperium/hyper/issues/3337)\n- [cve@mitre.org](https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61)\n- [cve@mitre.org](https://github.com/nghttp2/nghttp2/pull/1961)\n- [cve@mitre.org](https://news.ycombinator.com/item?id=37830987)\n- [cve@mitre.org](https://news.ycombinator.com/item?id=37830998)\n- [cve@mitre.org](https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/)\n- [cve@mitre.org](https://github.com/grpc/grpc-go/pull/6703)\n- [cve@mitre.org](https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244)\n- [cve@mitre.org](https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0)\n- [cve@mitre.org](https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html)\n- [cve@mitre.org](https://my.f5.com/manage/s/article/K000137106)\n- [cve@mitre.org](https://bugzilla.proxmox.com/show_bug.cgi?id=4988)\n- [cve@mitre.org](https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9)\n- [cve@mitre.org](https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/)\n- [cve@mitre.org](https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve)\n- [cve@mitre.org](https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088)\n- [cve@mitre.org](https://github.com/advisories/GHSA-vx74-f528-fxqg)\n- [cve@mitre.org](https://github.com/apache/trafficserver/pull/10564)\n- [cve@mitre.org](https://github.com/dotnet/announcements/issues/277)\n- [cve@mitre.org](https://github.com/facebook/proxygen/pull/466)\n- [cve@mitre.org](https://github.com/golang/go/issues/63417)\n- [cve@mitre.org](https://github.com/h2o/h2o/pull/3291)\n- [cve@mitre.org](https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf)\n- [cve@mitre.org](https://github.com/micrictor/http2-rst-stream)\n- [cve@mitre.org](https://github.com/microsoft/CBL-Mariner/pull/6381)\n- [cve@mitre.org](https://github.com/nodejs/node/pull/50121)\n- [cve@mitre.org](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo)\n- [cve@mitre.org](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487)\n- [cve@mitre.org](https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/)\n- [cve@mitre.org](https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q)\n- [cve@mitre.org](https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected)\n- [cve@mitre.org](https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14)\n- [cve@mitre.org](https://www.openwall.com/lists/oss-security/2023/10/10/6)\n- [cve@mitre.org](https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73)\n- [cve@mitre.org](https://github.com/advisories/GHSA-xpw8-rcwv-8f8p)\n- [cve@mitre.org](https://github.com/kubernetes/kubernetes/pull/121120)\n- [cve@mitre.org](https://github.com/opensearch-project/data-prepper/issues/3474)\n- [cve@mitre.org](https://github.com/oqtane/oqtane.framework/discussions/3367)\n- [cve@mitre.org](https://netty.io/news/2023/10/10/4-1-100-Final.html)\n- [cve@mitre.org](https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487)\n- [cve@mitre.org](https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack)\n- [cve@mitre.org](https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113)\n- [cve@mitre.org](https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1)\n- [cve@mitre.org](https://github.com/kazu-yamamoto/http2/issues/93)\n- [cve@mitre.org](https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html)\n- [cve@mitre.org](https://news.ycombinator.com/item?id=37837043)\n- [cve@mitre.org](https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487)\n- [cve@mitre.org](https://www.debian.org/security/2023/dsa-5521)\n- [cve@mitre.org](https://www.debian.org/security/2023/dsa-5522)\n- [cve@mitre.org](https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/)\n- [cve@mitre.org](https://access.redhat.com/security/cve/cve-2023-44487)\n- [cve@mitre.org](https://blog.vespa.ai/cve-2023-44487/)\n- [cve@mitre.org](https://bugzilla.redhat.com/show_bug.cgi?id=2242803)\n- [cve@mitre.org](https://bugzilla.suse.com/show_bug.cgi?id=1216123)\n- [cve@mitre.org](https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125)\n- [cve@mitre.org](https://github.com/advisories/GHSA-qppj-fm5r-hxr3)\n- [cve@mitre.org](https://github.com/etcd-io/etcd/issues/16740)\n- [cve@mitre.org](https://github.com/junkurihara/rust-rpxy/issues/97)\n- [cve@mitre.org](https://github.com/ninenines/cowboy/issues/1615)\n- [cve@mitre.org](https://github.com/tempesta-tech/tempesta/issues/1986)\n- [cve@mitre.org](https://github.com/varnishcache/varnish-cache/issues/3996)\n- [cve@mitre.org](https://istio.io/latest/news/security/istio-security-2023-004/)\n- [cve@mitre.org](https://ubuntu.com/security/CVE-2023-44487)\n- [cve@mitre.org](https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event)\n- [cve@mitre.org](https://github.com/apache/httpd-site/pull/10)\n- [cve@mitre.org](https://github.com/line/armeria/pull/5232)\n- [cve@mitre.org](https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632)\n- [cve@mitre.org](https://github.com/projectcontour/contour/pull/5826)\n- [cve@mitre.org](https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/)\n- [cve@mitre.org](https://github.com/Azure/AKS/issues/3947)\n- [cve@mitre.org](https://github.com/Kong/kong/discussions/11741)\n- [cve@mitre.org](https://github.com/akka/akka-http/issues/4323)\n- [cve@mitre.org](https://github.com/apache/apisix/issues/10320)\n- [cve@mitre.org](https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487)\n- [cve@mitre.org](https://github.com/openresty/openresty/issues/930)\n- [cve@mitre.org](https://security.paloaltonetworks.com/CVE-2023-44487)\n- [cve@mitre.org](https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/)\n- [cve@mitre.org](https://github.com/caddyserver/caddy/releases/tag/v2.7.5)\n- [cve@mitre.org](https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/10/13/4)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/10/13/9)\n- [cve@mitre.org](https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/)\n- [cve@mitre.org](https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html)\n- [CISA - Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n", "disclosureTime": "2023-10-10T14:15:10.883000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.76715", "probability": "0.00636" }, "exploit": "High", "filtered": { "ignored": [ { "created": "2023-10-11T19:31:20.581Z", "expires": "2023-11-10T19:31:20.564Z", "path": [ "*" ], "reason": "Waiting for Debian upgrade", "source": "cli" } ] }, "fixedIn": [], "from": [ "docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@*", "curl@7.88.1-10+deb12u4", "curl/libcurl4@7.88.1-10+deb12u4", "nghttp2/libnghttp2-14@1.52.0-1" ], "id": "SNYK-DEBIAN12-NGHTTP2-5953379", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-44487" ], "CWE": [ "CWE-400" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-10-14T13:10:42.753047Z", "name": "nghttp2/libnghttp2-14", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "nghttp2", "patches": [], "publicationTime": "2023-10-11T01:07:39.545468Z", "references": [ { "title": "https://security-tracker.debian.org/tracker/CVE-2023-44487", "url": "https://security-tracker.debian.org/tracker/CVE-2023-44487" }, { "title": "https://aws.amazon.com/security/security-bulletins/AWS-2023-011/", "url": "https://aws.amazon.com/security/security-bulletins/AWS-2023-011/" }, { "title": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/", "url": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/" }, { "title": "https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/", "url": "https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/" }, { "title": "https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/", "url": "https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/" }, { "title": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack", "url": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack" }, { "title": "https://news.ycombinator.com/item?id=37831062", "url": "https://news.ycombinator.com/item?id=37831062" }, { "title": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/", "url": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/" }, { "title": "https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack", "url": "https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack" }, { "title": "https://chaos.social/@icing/111210915918780532", "url": "https://chaos.social/@icing/111210915918780532" }, { "title": "https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764", "url": "https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764" }, { "title": "https://github.com/alibaba/tengine/issues/1872", "url": "https://github.com/alibaba/tengine/issues/1872" }, { "title": "https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2", "url": "https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2" }, { "title": "https://github.com/bcdannyboy/CVE-2023-44487", "url": "https://github.com/bcdannyboy/CVE-2023-44487" }, { "title": "https://github.com/caddyserver/caddy/issues/5877", "url": "https://github.com/caddyserver/caddy/issues/5877" }, { "title": "https://github.com/eclipse/jetty.project/issues/10679", "url": "https://github.com/eclipse/jetty.project/issues/10679" }, { "title": "https://github.com/envoyproxy/envoy/pull/30055", "url": "https://github.com/envoyproxy/envoy/pull/30055" }, { "title": "https://github.com/haproxy/haproxy/issues/2312", "url": "https://github.com/haproxy/haproxy/issues/2312" }, { "title": "https://github.com/hyperium/hyper/issues/3337", "url": "https://github.com/hyperium/hyper/issues/3337" }, { "title": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61", "url": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61" }, { "title": "https://github.com/nghttp2/nghttp2/pull/1961", "url": "https://github.com/nghttp2/nghttp2/pull/1961" }, { "title": "https://news.ycombinator.com/item?id=37830987", "url": "https://news.ycombinator.com/item?id=37830987" }, { "title": "https://news.ycombinator.com/item?id=37830998", "url": "https://news.ycombinator.com/item?id=37830998" }, { "title": "https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/", "url": "https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/" }, { "title": "https://github.com/grpc/grpc-go/pull/6703", "url": "https://github.com/grpc/grpc-go/pull/6703" }, { "title": "https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1%23L239-L244", "url": "https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1%23L239-L244" }, { "title": "https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0", "url": "https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0" }, { "title": "https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html", "url": "https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html" }, { "title": "https://my.f5.com/manage/s/article/K000137106", "url": "https://my.f5.com/manage/s/article/K000137106" }, { "title": "https://bugzilla.proxmox.com/show_bug.cgi?id=4988", "url": "https://bugzilla.proxmox.com/show_bug.cgi?id=4988" }, { "title": "https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9", "url": "https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9" }, { "title": "https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/", "url": "https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/" }, { "title": "https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve", "url": "https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve" }, { "title": "https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088", "url": "https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088" }, { "title": "https://github.com/advisories/GHSA-vx74-f528-fxqg", "url": "https://github.com/advisories/GHSA-vx74-f528-fxqg" }, { "title": "https://github.com/apache/trafficserver/pull/10564", "url": "https://github.com/apache/trafficserver/pull/10564" }, { "title": "https://github.com/dotnet/announcements/issues/277", "url": "https://github.com/dotnet/announcements/issues/277" }, { "title": "https://github.com/facebook/proxygen/pull/466", "url": "https://github.com/facebook/proxygen/pull/466" }, { "title": "https://github.com/golang/go/issues/63417", "url": "https://github.com/golang/go/issues/63417" }, { "title": "https://github.com/h2o/h2o/pull/3291", "url": "https://github.com/h2o/h2o/pull/3291" }, { "title": "https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf", "url": "https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf" }, { "title": "https://github.com/micrictor/http2-rst-stream", "url": "https://github.com/micrictor/http2-rst-stream" }, { "title": "https://github.com/microsoft/CBL-Mariner/pull/6381", "url": "https://github.com/microsoft/CBL-Mariner/pull/6381" }, { "title": "https://github.com/nodejs/node/pull/50121", "url": "https://github.com/nodejs/node/pull/50121" }, { "title": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo", "url": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo" }, { "title": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487" }, { "title": "https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/", "url": "https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/" }, { "title": "https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q", "url": "https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q" }, { "title": "https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected", "url": "https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected" }, { "title": "https://tomcat.apache.org/security-10.html%23Fixed_in_Apache_Tomcat_10.1.14", "url": "https://tomcat.apache.org/security-10.html%23Fixed_in_Apache_Tomcat_10.1.14" }, { "title": "https://www.openwall.com/lists/oss-security/2023/10/10/6", "url": "https://www.openwall.com/lists/oss-security/2023/10/10/6" }, { "title": "https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1%23L73", "url": "https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1%23L73" }, { "title": "https://github.com/advisories/GHSA-xpw8-rcwv-8f8p", "url": "https://github.com/advisories/GHSA-xpw8-rcwv-8f8p" }, { "title": "https://github.com/kubernetes/kubernetes/pull/121120", "url": "https://github.com/kubernetes/kubernetes/pull/121120" }, { "title": "https://github.com/opensearch-project/data-prepper/issues/3474", "url": "https://github.com/opensearch-project/data-prepper/issues/3474" }, { "title": "https://github.com/oqtane/oqtane.framework/discussions/3367", "url": "https://github.com/oqtane/oqtane.framework/discussions/3367" }, { "title": "https://netty.io/news/2023/10/10/4-1-100-Final.html", "url": "https://netty.io/news/2023/10/10/4-1-100-Final.html" }, { "title": "https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487", "url": "https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487" }, { "title": "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack", "url": "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack" }, { "title": "https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c%23L1101-L1113", "url": "https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c%23L1101-L1113" }, { "title": "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1", "url": "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1" }, { "title": "https://github.com/kazu-yamamoto/http2/issues/93", "url": "https://github.com/kazu-yamamoto/http2/issues/93" }, { "title": "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html", "url": "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html" }, { "title": "https://news.ycombinator.com/item?id=37837043", "url": "https://news.ycombinator.com/item?id=37837043" }, { "title": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487", "url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487" }, { "title": "https://www.debian.org/security/2023/dsa-5521", "url": "https://www.debian.org/security/2023/dsa-5521" }, { "title": "https://www.debian.org/security/2023/dsa-5522", "url": "https://www.debian.org/security/2023/dsa-5522" }, { "title": "https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/", "url": "https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/" }, { "title": "https://access.redhat.com/security/cve/cve-2023-44487", "url": "https://access.redhat.com/security/cve/cve-2023-44487" }, { "title": "https://blog.vespa.ai/cve-2023-44487/", "url": "https://blog.vespa.ai/cve-2023-44487/" }, { "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803" }, { "title": "https://bugzilla.suse.com/show_bug.cgi?id=1216123", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1216123" }, { "title": "https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125", "url": "https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125" }, { "title": "https://github.com/advisories/GHSA-qppj-fm5r-hxr3", "url": "https://github.com/advisories/GHSA-qppj-fm5r-hxr3" }, { "title": "https://github.com/etcd-io/etcd/issues/16740", "url": "https://github.com/etcd-io/etcd/issues/16740" }, { "title": "https://github.com/junkurihara/rust-rpxy/issues/97", "url": "https://github.com/junkurihara/rust-rpxy/issues/97" }, { "title": "https://github.com/ninenines/cowboy/issues/1615", "url": "https://github.com/ninenines/cowboy/issues/1615" }, { "title": "https://github.com/tempesta-tech/tempesta/issues/1986", "url": "https://github.com/tempesta-tech/tempesta/issues/1986" }, { "title": "https://github.com/varnishcache/varnish-cache/issues/3996", "url": "https://github.com/varnishcache/varnish-cache/issues/3996" }, { "title": "https://istio.io/latest/news/security/istio-security-2023-004/", "url": "https://istio.io/latest/news/security/istio-security-2023-004/" }, { "title": "https://ubuntu.com/security/CVE-2023-44487", "url": "https://ubuntu.com/security/CVE-2023-44487" }, { "title": "https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event", "url": "https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event" }, { "title": "https://github.com/apache/httpd-site/pull/10", "url": "https://github.com/apache/httpd-site/pull/10" }, { "title": "https://github.com/line/armeria/pull/5232", "url": "https://github.com/line/armeria/pull/5232" }, { "title": "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632", "url": "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632" }, { "title": "https://github.com/projectcontour/contour/pull/5826", "url": "https://github.com/projectcontour/contour/pull/5826" }, { "title": "https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/", "url": "https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/" }, { "title": "https://github.com/Azure/AKS/issues/3947", "url": "https://github.com/Azure/AKS/issues/3947" }, { "title": "https://github.com/Kong/kong/discussions/11741", "url": "https://github.com/Kong/kong/discussions/11741" }, { "title": "https://github.com/akka/akka-http/issues/4323", "url": "https://github.com/akka/akka-http/issues/4323" }, { "title": "https://github.com/apache/apisix/issues/10320", "url": "https://github.com/apache/apisix/issues/10320" }, { "title": "https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487", "url": "https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487" }, { "title": "https://github.com/openresty/openresty/issues/930", "url": "https://github.com/openresty/openresty/issues/930" }, { "title": "https://security.paloaltonetworks.com/CVE-2023-44487", "url": "https://security.paloaltonetworks.com/CVE-2023-44487" }, { "title": "https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/", "url": "https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/" }, { "title": "https://github.com/caddyserver/caddy/releases/tag/v2.7.5", "url": "https://github.com/caddyserver/caddy/releases/tag/v2.7.5" }, { "title": "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html" }, { "title": "http://www.openwall.com/lists/oss-security/2023/10/13/4", "url": "http://www.openwall.com/lists/oss-security/2023/10/13/4" }, { "title": "http://www.openwall.com/lists/oss-security/2023/10/13/9", "url": "http://www.openwall.com/lists/oss-security/2023/10/13/9" }, { "title": "https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/", "url": "https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/" }, { "title": "https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html", "url": "https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html" }, { "title": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "relativeImportance": "not yet assigned", "semver": { "vulnerable": [ "*" ] }, "severity": "high", "severityWithCritical": "high", "socialTrendAlert": true, "title": "Resource Exhaustion", "upgradePath": [], "version": "1.52.0-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-08-29T02:14:12.065902Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-10-11T01:10:52.532167Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nLibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-40745)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-40745)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2235265)\n", "disclosureTime": "2023-10-05T19:15:11.260000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.39290", "probability": "0.00094" }, "exploit": "Not Defined", "filtered": { "ignored": [ { "created": "2023-10-11T19:30:13.242Z", "expires": "2023-11-10T19:30:13.235Z", "path": [ "*" ], "reason": "Waiting for Debian upgrade", "source": "cli" } ] }, "fixedIn": [], "from": [ "docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@*", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-5862859", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-40745" ], "CWE": [ "CWE-190" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-10-11T01:10:52.604444Z", "name": "tiff/libtiff6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2023-08-29T02:14:12.010192Z", "references": [ { "title": "https://security-tracker.debian.org/tracker/CVE-2023-40745", "url": "https://security-tracker.debian.org/tracker/CVE-2023-40745" }, { "title": "https://access.redhat.com/security/cve/CVE-2023-40745", "url": "https://access.redhat.com/security/cve/CVE-2023-40745" }, { "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2235265", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2235265" } ], "relativeImportance": "not yet assigned", "semver": { "vulnerable": [ "*" ] }, "severity": "medium", "severityWithCritical": "medium", "socialTrendAlert": false, "title": "Integer Overflow or Wraparound", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-08-29T02:15:15.690236Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-10-11T01:10:52.697590Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-41175)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-41175)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2235264)\n", "disclosureTime": "2023-10-05T19:15:11.340000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.39290", "probability": "0.00094" }, "exploit": "Not Defined", "filtered": { "ignored": [ { "created": "2023-10-11T19:30:34.270Z", "expires": "2023-11-10T19:30:34.260Z", "path": [ "*" ], "reason": "Waiting for Debian upgrade", "source": "cli" } ] }, "fixedIn": [], "from": [ "docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@*", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-5862863", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-41175" ], "CWE": [ "CWE-190" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-10-11T01:10:52.784935Z", "name": "tiff/libtiff6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2023-08-29T02:14:21.842855Z", "references": [ { "title": "https://security-tracker.debian.org/tracker/CVE-2023-41175", "url": "https://security-tracker.debian.org/tracker/CVE-2023-41175" }, { "title": "https://access.redhat.com/security/cve/CVE-2023-41175", "url": "https://access.redhat.com/security/cve/CVE-2023-41175" }, { "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2235264", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2235264" } ], "relativeImportance": "not yet assigned", "semver": { "vulnerable": [ "*" ] }, "severity": "medium", "severityWithCritical": "medium", "socialTrendAlert": false, "title": "Integer Overflow or Wraparound", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-10-05T14:53:13.833743Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-07-12T13:48:20.082991Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-10-11T01:10:46.904290Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes this memory leak issue, resulting an application crash, eventually leading to a denial of service.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3576)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-3576)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2219340)\n", "disclosureTime": "2023-10-04T19:15:10.340000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07179", "probability": "0.00043" }, "exploit": "Not Defined", "filtered": { "ignored": [ { "created": "2023-10-11T19:30:47.874Z", "expires": "2023-11-10T19:30:47.863Z", "path": [ "*" ], "reason": "Waiting for Debian upgrade", "source": "cli" } ] }, "fixedIn": [], "from": [ "docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@*", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-5934984", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3576" ], "CWE": [ "CWE-401" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-10-11T01:10:47.010194Z", "name": "tiff/libtiff6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2023-10-05T14:51:44.129440Z", "references": [ { "title": "https://security-tracker.debian.org/tracker/CVE-2023-3576", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3576" }, { "title": "https://access.redhat.com/security/cve/CVE-2023-3576", "url": "https://access.redhat.com/security/cve/CVE-2023-3576" }, { "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2219340", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219340" } ], "relativeImportance": "not yet assigned", "semver": { "vulnerable": [ "*" ] }, "severity": "medium", "severityWithCritical": "medium", "socialTrendAlert": false, "title": "Memory Leak", "upgradePath": [], "version": "4.5.0-6" } ], "patch": [] }, "hasUnknownVersions": false, "ignoreSettings": { "adminOnly": false, "disregardFilesystemIgnores": false, "reasonRequired": false }, "isPrivate": true, "licensesPolicy": { "orgLicenseRules": { "AGPL-1.0": { "instructions": "", "licenseType": "AGPL-1.0", "severity": "high" }, "AGPL-3.0": { "instructions": "", "licenseType": "AGPL-3.0", "severity": "high" }, "Artistic-1.0": { "instructions": "", "licenseType": "Artistic-1.0", "severity": "medium" }, "Artistic-2.0": { "instructions": "", "licenseType": "Artistic-2.0", "severity": "medium" }, "CDDL-1.0": { "instructions": "", "licenseType": "CDDL-1.0", "severity": "medium" }, "CPOL-1.02": { "instructions": "", "licenseType": "CPOL-1.02", "severity": "high" }, "EPL-1.0": { "instructions": "", "licenseType": "EPL-1.0", "severity": "medium" }, "GPL-2.0": { "instructions": "", "licenseType": "GPL-2.0", "severity": "high" }, "GPL-3.0": { "instructions": "", "licenseType": "GPL-3.0", "severity": "high" }, "LGPL-2.0": { "instructions": "", "licenseType": "LGPL-2.0", "severity": "medium" }, "LGPL-2.1": { "instructions": "", "licenseType": "LGPL-2.1", "severity": "medium" }, "LGPL-3.0": { "instructions": "", "licenseType": "LGPL-3.0", "severity": "medium" }, "MPL-1.1": { "instructions": "", "licenseType": "MPL-1.1", "severity": "medium" }, "MPL-2.0": { "instructions": "", "licenseType": "MPL-2.0", "severity": "medium" }, "MS-RL": { "instructions": "", "licenseType": "MS-RL", "severity": "medium" }, "SimPL-2.0": { "instructions": "", "licenseType": "SimPL-2.0", "severity": "high" } }, "severities": {} }, "ok": false, "org": "jonjagger", "packageManager": "deb", "path": "274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@sha256:6442cf22ccba72a98e68d772c38c2cfb2492e5a34ad4cf68f6f0e69694d5b00a/nginx:b1ff2f7", "platform": "linux/amd64", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\n# ignores vulnerabilities until expiry date; change duration by modifying expiry date\nignore:\n SNYK-DEBIAN12-TIFF-5862859:\n - '*':\n reason: Waiting for Debian upgrade\n expires: 2023-11-10T19:30:13.235Z\n created: 2023-10-11T19:30:13.242Z\n source: cli\n SNYK-DEBIAN12-TIFF-5862863:\n - '*':\n reason: Waiting for Debian upgrade\n expires: 2023-11-10T19:30:34.260Z\n created: 2023-10-11T19:30:34.270Z\n source: cli\n SNYK-DEBIAN12-TIFF-5934984:\n - '*':\n reason: Waiting for Debian upgrade\n expires: 2023-11-10T19:30:47.863Z\n created: 2023-10-11T19:30:47.874Z\n source: cli\n SNYK-DEBIAN12-NGHTTP2-5953379:\n - '*':\n reason: Waiting for Debian upgrade\n expires: 2023-11-10T19:31:20.564Z\n created: 2023-10-11T19:31:20.581Z\n source: cli\npatch: {}\n", "projectName": "docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7", "severityThreshold": "medium", "summary": "6 medium or high or critical severity vulnerable dependency paths", "uniqueCount": 2, "vulnerabilities": [ { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cpes": [], "creationTime": "2023-10-04T01:39:47.824771Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "SUSE", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "modificationTime": "2023-10-05T11:03:51.864684Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 7.8, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2023-10-14T01:10:44.765946Z", "severity": "high" } ], "cvssScore": 7.8, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libxpm` package and not the `libxpm` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges.\n## Remediation\nThere is no fixed version for `Debian:12` `libxpm`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-43787)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-43787)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2242254)\n", "disclosureTime": "2023-10-10T13:15:22.083000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07816", "probability": "0.00043" }, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@*", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libxpm/libxpm4@1:3.5.12-1.1+deb12u1" ], "id": "SNYK-DEBIAN12-LIBXPM-5927176", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-43787" ], "CWE": [ "CWE-190" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-10-14T01:10:44.795752Z", "name": "libxpm/libxpm4", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "libxpm", "patches": [], "publicationTime": "2023-10-04T01:35:08.049153Z", "references": [ { "title": "https://security-tracker.debian.org/tracker/CVE-2023-43787", "url": "https://security-tracker.debian.org/tracker/CVE-2023-43787" }, { "title": "https://access.redhat.com/security/cve/CVE-2023-43787", "url": "https://access.redhat.com/security/cve/CVE-2023-43787" }, { "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2242254", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242254" } ], "relativeImportance": "not yet assigned", "semver": { "vulnerable": [ "*" ] }, "severity": "high", "severityWithCritical": "high", "socialTrendAlert": false, "title": "Integer Overflow or Wraparound", "upgradePath": [], "version": "1:3.5.12-1.1+deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-10-04T01:39:54.574701Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-10-05T11:03:53.170531Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-10-14T01:10:44.669482Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libxpm` package and not the `libxpm` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.\n## Remediation\nThere is no fixed version for `Debian:12` `libxpm`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-43786)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-43786)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2242253)\n", "disclosureTime": "2023-10-10T13:15:22.023000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.05682", "probability": "0.00042" }, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|274425519734.dkr.ecr.eu-central-1.amazonaws.com/nginx:b1ff2f7@*", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libxpm/libxpm4@1:3.5.12-1.1+deb12u1" ], "id": "SNYK-DEBIAN12-LIBXPM-5927179", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-43786" ], "CWE": [ "CWE-835" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-10-14T01:10:44.728351Z", "name": "libxpm/libxpm4", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "libxpm", "patches": [], "publicationTime": "2023-10-04T01:36:23.157139Z", "references": [ { "title": "https://security-tracker.debian.org/tracker/CVE-2023-43786", "url": "https://security-tracker.debian.org/tracker/CVE-2023-43786" }, { "title": "https://access.redhat.com/security/cve/CVE-2023-43786", "url": "https://access.redhat.com/security/cve/CVE-2023-43786" }, { "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2242253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242253" } ], "relativeImportance": "not yet assigned", "semver": { "vulnerable": [ "*" ] }, "severity": "medium", "severityWithCritical": "medium", "socialTrendAlert": false, "title": "Loop with Unreachable Exit Condition ('Infinite Loop')", "upgradePath": [], "version": "1:3.5.12-1.1+deb12u1" } ] }, "created_at": 1697361506.7932181, "has_audit_package": true }