ALT-BU-2024-9671-1
Branch c10f2 update bulletin.
Package dotnet-runtime-7.0 updated to version 7.0.14-alt1 for branch c10f2 in task 348654.
Closed vulnerabilities
BDU:2023-02907
Уязвимость программной платформы Microsoft .NET, связанная с некорректной обработкой пути поиска к библиотекам DLL,позволяющая нарушителю выполнить произвольный код
BDU:2023-03210
Уязвимость программных платформ Microsoft .NET Framework, .NET и средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
BDU:2023-03308
Уязвимость программных платформ Microsoft .NET Framework, .NET и средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
BDU:2023-03339
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio и программной платформы Microsoft.NET, позволяющая нарушителю повысить свои привилегии
BDU:2023-03439
Уязвимость программных платформ Microsoft .NET Framework, .NET и средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостаточной проверкой входных данных, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-03440
Уязвимость программных платформ Microsoft .NET Framework, .NET и средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии
BDU:2023-03531
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio и программной платформы Microsoft.NET, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
BDU:2023-03789
Уязвимость программной платформы .NET и средства разработки программного обеспечения Microsoft Visual Studio, вызванная ошибками синхронизации при использовании общего ресурса, позволяющая нарушителю обойти существующие ограничения безопасности
BDU:2023-03790
Уязвимость программной платформы .NET и средства разработки программного обеспечения Microsoft Visual Studio, вызванная ошибками синхронизации при использовании общего ресурса, позволяющая нарушителю повысить свои привилегии
BDU:2023-04540
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio и программной платформы Microsoft.NET Framework, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-04615
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio, программной платформы Microsoft.NET, и программной платформы ASP.NET Core, позволяющая нарушителю получить доступ к конфиденциальной информации
BDU:2023-04621
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio, программной платформы Microsoft.NET, связанная с недостаточной проверкой входных данных, позволяющая нарушителю раскрыть защищаемую информацию
BDU:2023-05593
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
BDU:2023-05594
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
BDU:2023-05595
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
BDU:2023-05605
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
BDU:2023-06110
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-06559
Уязвимость реализации протокола HTTP/2, связанная с возможностью формирования потока запросов в рамках уже установленного сетевого соединения, без открытия новых сетевых соединений и без подтверждения получения пакетов, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-06639
Уязвимость реализации сетевого протокола QUIC операционной системы Windows, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-06839
Уязвимость реализации сетевого протокола QUIC операционной системы Windows, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-08244
Уязвимость программной платформы Microsoft .NET Framework, средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии
BDU:2023-08245
Уязвимость программной платформы ASP.NET Core, связанная с ошибками в настройках безопасности, позволяющая нарушителю раскрыть защищаемую информацию
Modified: 2024-11-21
CVE-2023-24895
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-24897
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-24936
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
Modified: 2024-11-21
CVE-2023-28260
.NET DLL Hijacking Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-29331
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
Modified: 2024-11-21
CVE-2023-29337
NuGet Client Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-32032
.NET and Visual Studio Elevation of Privilege Vulnerability
Modified: 2024-11-21
CVE-2023-33126
.NET and Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-33127
.NET and Visual Studio Elevation of Privilege Vulnerability
Modified: 2024-11-21
CVE-2023-33128
.NET and Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-33135
.NET and Visual Studio Elevation of Privilege Vulnerability
Modified: 2025-01-01
CVE-2023-33170
ASP.NET and Visual Studio Security Feature Bypass Vulnerability
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/
- ASP.NET and Visual Studio Security Feature Bypass Vulnerability
- ASP.NET and Visual Studio Security Feature Bypass Vulnerability
Modified: 2025-01-01
CVE-2023-35390
.NET and Visual Studio Remote Code Execution Vulnerability
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CL2L4WE5QRT7WEXANYXSKSU43APC5N2V/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWVZFKTLNMNKPZ755EMRYIA6GHFOWGKY/
- .NET and Visual Studio Remote Code Execution Vulnerability
- .NET and Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-35391
ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability
Modified: 2024-11-21
CVE-2023-36049
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
Modified: 2024-11-21
CVE-2023-36435
Microsoft QUIC Denial of Service Vulnerability
Modified: 2025-01-01
CVE-2023-36558
ASP.NET Core Security Feature Bypass Vulnerability
Modified: 2024-11-21
CVE-2023-36792
Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-36793
Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-36794
Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-36796
Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-36799
.NET Core and Visual Studio Denial of Service Vulnerability
Modified: 2024-11-21
CVE-2023-38171
Microsoft QUIC Denial of Service Vulnerability
Modified: 2024-11-21
CVE-2023-38178
.NET Core and Visual Studio Denial of Service Vulnerability
Modified: 2025-03-08
CVE-2023-38180
.NET and Visual Studio Denial of Service Vulnerability
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CL2L4WE5QRT7WEXANYXSKSU43APC5N2V/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWVZFKTLNMNKPZ755EMRYIA6GHFOWGKY/
- .NET and Visual Studio Denial of Service Vulnerability
- .NET and Visual Studio Denial of Service Vulnerability
Modified: 2025-04-03
CVE-2023-44487
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
- [oss-security] 20231010 CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231010 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231018 Vulnerability in Jenkins
- [oss-security] 20231018 Vulnerability in Jenkins
- [oss-security] 20231018 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231018 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231019 CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST
- [oss-security] 20231019 CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST
- [oss-security] 20231020 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231020 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- https://access.redhat.com/security/cve/cve-2023-44487
- https://access.redhat.com/security/cve/cve-2023-44487
- https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/
- https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/
- https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
- https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
- https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
- https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
- https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/
- https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/
- https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack
- https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack
- https://blog.vespa.ai/cve-2023-44487/
- https://blog.vespa.ai/cve-2023-44487/
- https://bugzilla.proxmox.com/show_bug.cgi?id=4988
- https://bugzilla.proxmox.com/show_bug.cgi?id=4988
- https://bugzilla.redhat.com/show_bug.cgi?id=2242803
- https://bugzilla.redhat.com/show_bug.cgi?id=2242803
- https://bugzilla.suse.com/show_bug.cgi?id=1216123
- https://bugzilla.suse.com/show_bug.cgi?id=1216123
- https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9
- https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9
- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/
- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/
- https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
- https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
- https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125
- https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125
- https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715
- https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715
- https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve
- https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve
- https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
- https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
- https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088
- https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088
- https://github.com/advisories/GHSA-qppj-fm5r-hxr3
- https://github.com/advisories/GHSA-qppj-fm5r-hxr3
- https://github.com/advisories/GHSA-vx74-f528-fxqg
- https://github.com/advisories/GHSA-vx74-f528-fxqg
- https://github.com/advisories/GHSA-xpw8-rcwv-8f8p
- https://github.com/advisories/GHSA-xpw8-rcwv-8f8p
- https://github.com/akka/akka-http/issues/4323
- https://github.com/akka/akka-http/issues/4323
- https://github.com/alibaba/tengine/issues/1872
- https://github.com/alibaba/tengine/issues/1872
- https://github.com/apache/apisix/issues/10320
- https://github.com/apache/apisix/issues/10320
- https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113
- https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113
- https://github.com/apache/httpd-site/pull/10
- https://github.com/apache/httpd-site/pull/10
- https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2
- https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2
- https://github.com/apache/trafficserver/pull/10564
- https://github.com/apache/trafficserver/pull/10564
- https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487
- https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487
- https://github.com/Azure/AKS/issues/3947
- https://github.com/Azure/AKS/issues/3947
- https://github.com/bcdannyboy/CVE-2023-44487
- https://github.com/bcdannyboy/CVE-2023-44487
- https://github.com/caddyserver/caddy/issues/5877
- https://github.com/caddyserver/caddy/issues/5877
- https://github.com/caddyserver/caddy/releases/tag/v2.7.5
- https://github.com/caddyserver/caddy/releases/tag/v2.7.5
- https://github.com/dotnet/announcements/issues/277
- https://github.com/dotnet/announcements/issues/277
- https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73
- https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73
- https://github.com/eclipse/jetty.project/issues/10679
- https://github.com/eclipse/jetty.project/issues/10679
- https://github.com/envoyproxy/envoy/pull/30055
- https://github.com/envoyproxy/envoy/pull/30055
- https://github.com/etcd-io/etcd/issues/16740
- https://github.com/etcd-io/etcd/issues/16740
- https://github.com/facebook/proxygen/pull/466
- https://github.com/facebook/proxygen/pull/466
- https://github.com/golang/go/issues/63417
- https://github.com/golang/go/issues/63417
- https://github.com/grpc/grpc/releases/tag/v1.59.2
- https://github.com/grpc/grpc-go/pull/6703
- https://github.com/grpc/grpc-go/pull/6703
- https://github.com/h2o/h2o/pull/3291
- https://github.com/h2o/h2o/pull/3291
- https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf
- https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf
- https://github.com/haproxy/haproxy/issues/2312
- https://github.com/haproxy/haproxy/issues/2312
- https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244
- https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244
- https://github.com/junkurihara/rust-rpxy/issues/97
- https://github.com/junkurihara/rust-rpxy/issues/97
- https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1
- https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1
- https://github.com/kazu-yamamoto/http2/issues/93
- https://github.com/kazu-yamamoto/http2/issues/93
- https://github.com/Kong/kong/discussions/11741
- https://github.com/Kong/kong/discussions/11741
- https://github.com/kubernetes/kubernetes/pull/121120
- https://github.com/kubernetes/kubernetes/pull/121120
- https://github.com/line/armeria/pull/5232
- https://github.com/line/armeria/pull/5232
- https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632
- https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632
- https://github.com/micrictor/http2-rst-stream
- https://github.com/micrictor/http2-rst-stream
- https://github.com/microsoft/CBL-Mariner/pull/6381
- https://github.com/microsoft/CBL-Mariner/pull/6381
- https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
- https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
- https://github.com/nghttp2/nghttp2/pull/1961
- https://github.com/nghttp2/nghttp2/pull/1961
- https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
- https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
- https://github.com/ninenines/cowboy/issues/1615
- https://github.com/ninenines/cowboy/issues/1615
- https://github.com/nodejs/node/pull/50121
- https://github.com/nodejs/node/pull/50121
- https://github.com/openresty/openresty/issues/930
- https://github.com/openresty/openresty/issues/930
- https://github.com/opensearch-project/data-prepper/issues/3474
- https://github.com/opensearch-project/data-prepper/issues/3474
- https://github.com/oqtane/oqtane.framework/discussions/3367
- https://github.com/oqtane/oqtane.framework/discussions/3367
- https://github.com/projectcontour/contour/pull/5826
- https://github.com/projectcontour/contour/pull/5826
- https://github.com/tempesta-tech/tempesta/issues/1986
- https://github.com/tempesta-tech/tempesta/issues/1986
- https://github.com/varnishcache/varnish-cache/issues/3996
- https://github.com/varnishcache/varnish-cache/issues/3996
- https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
- https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
- https://istio.io/latest/news/security/istio-security-2023-004/
- https://istio.io/latest/news/security/istio-security-2023-004/
- https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/
- https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/
- https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q
- https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q
- [debian-lts-announce] 20231013 [SECURITY] [DLA 3617-1] tomcat9 security update
- [debian-lts-announce] 20231013 [SECURITY] [DLA 3617-1] tomcat9 security update
- [debian-lts-announce] 20231016 [SECURITY] [DLA 3621-1] nghttp2 security update
- [debian-lts-announce] 20231016 [SECURITY] [DLA 3621-1] nghttp2 security update
- [debian-lts-announce] 20231016 [SECURITY] [DLA 3617-2] tomcat9 regression update
- [debian-lts-announce] 20231016 [SECURITY] [DLA 3617-2] tomcat9 regression update
- [debian-lts-announce] 20231030 [SECURITY] [DLA 3641-1] jetty9 security update
- [debian-lts-announce] 20231030 [SECURITY] [DLA 3641-1] jetty9 security update
- [debian-lts-announce] 20231031 [SECURITY] [DLA 3638-1] h2o security update
- [debian-lts-announce] 20231031 [SECURITY] [DLA 3638-1] h2o security update
- [debian-lts-announce] 20231105 [SECURITY] [DLA 3645-1] trafficserver security update
- [debian-lts-announce] 20231105 [SECURITY] [DLA 3645-1] trafficserver security update
- [debian-lts-announce] 20231119 [SECURITY] [DLA 3656-1] netty security update
- [debian-lts-announce] 20231119 [SECURITY] [DLA 3656-1] netty security update
- FEDORA-2023-c0c6a91330
- FEDORA-2023-7b52921cae
- FEDORA-2023-0259c3f26f
- FEDORA-2023-4bf641255e
- FEDORA-2023-d5030c983c
- FEDORA-2023-4d2fd884ea
- FEDORA-2023-dbe64661af
- FEDORA-2023-5ff7bf1dd8
- FEDORA-2023-ed2642fd58
- FEDORA-2023-fe53e13b5b
- FEDORA-2023-f66fc0f62a
- FEDORA-2023-b2c50535cb
- FEDORA-2023-1caffb88af
- FEDORA-2023-3f70b8d406
- FEDORA-2023-492b7be466
- FEDORA-2023-17efd3f2cd
- FEDORA-2023-e9c04d81c1
- FEDORA-2023-822aab0a5a
- FEDORA-2023-7934802344
- FEDORA-2023-54fadada12
- FEDORA-2023-2a9214af5f
- FEDORA-2023-c0c6a91330
- FEDORA-2023-7b52921cae
- FEDORA-2023-0259c3f26f
- FEDORA-2023-4bf641255e
- FEDORA-2023-d5030c983c
- FEDORA-2023-4d2fd884ea
- FEDORA-2023-dbe64661af
- FEDORA-2023-5ff7bf1dd8
- FEDORA-2023-ed2642fd58
- FEDORA-2023-fe53e13b5b
- FEDORA-2023-f66fc0f62a
- FEDORA-2023-b2c50535cb
- FEDORA-2023-1caffb88af
- FEDORA-2023-3f70b8d406
- FEDORA-2023-492b7be466
- FEDORA-2023-17efd3f2cd
- FEDORA-2023-e9c04d81c1
- FEDORA-2023-822aab0a5a
- FEDORA-2023-7934802344
- FEDORA-2023-54fadada12
- FEDORA-2023-2a9214af5f
- https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html
- https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html
- https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html
- https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html
- https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html
- https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html
- https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/
- https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487
- https://my.f5.com/manage/s/article/K000137106
- https://my.f5.com/manage/s/article/K000137106
- https://netty.io/news/2023/10/10/4-1-100-Final.html
- https://netty.io/news/2023/10/10/4-1-100-Final.html
- https://news.ycombinator.com/item?id=37830987
- https://news.ycombinator.com/item?id=37830987
- https://news.ycombinator.com/item?id=37830998
- https://news.ycombinator.com/item?id=37830998
- https://news.ycombinator.com/item?id=37831062
- https://news.ycombinator.com/item?id=37831062
- https://news.ycombinator.com/item?id=37837043
- https://news.ycombinator.com/item?id=37837043
- https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/
- https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/
- https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected
- https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected
- GLSA-202311-09
- GLSA-202311-09
- https://security.netapp.com/advisory/ntap-20231016-0001/
- https://security.netapp.com/advisory/ntap-20231016-0001/
- https://security.netapp.com/advisory/ntap-20240426-0007/
- https://security.netapp.com/advisory/ntap-20240426-0007/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://security.netapp.com/advisory/ntap-20240621-0007/
- https://security.netapp.com/advisory/ntap-20240621-0007/
- https://security.paloaltonetworks.com/CVE-2023-44487
- https://security.paloaltonetworks.com/CVE-2023-44487
- https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14
- https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14
- https://ubuntu.com/security/CVE-2023-44487
- https://ubuntu.com/security/CVE-2023-44487
- https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/
- https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/
- https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
- https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
- https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event
- https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event
- DSA-5521
- DSA-5521
- DSA-5522
- DSA-5522
- DSA-5540
- DSA-5540
- DSA-5549
- DSA-5549
- DSA-5558
- DSA-5558
- DSA-5570
- DSA-5570
- https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487
- https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487
- https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/
- https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/
- https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
- https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
- https://www.openwall.com/lists/oss-security/2023/10/10/6
- https://www.openwall.com/lists/oss-security/2023/10/10/6
- https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack
- https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack
- https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/
- https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/
- https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause
Closed bugs
30-hostname returned non-zero exit status 1
Package dotnet-bootstrap-7.0 updated to version 7.0.14-alt1 for branch c10f2 in task 348654.
Closed vulnerabilities
BDU:2023-02907
Уязвимость программной платформы Microsoft .NET, связанная с некорректной обработкой пути поиска к библиотекам DLL,позволяющая нарушителю выполнить произвольный код
BDU:2023-03210
Уязвимость программных платформ Microsoft .NET Framework, .NET и средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
BDU:2023-03308
Уязвимость программных платформ Microsoft .NET Framework, .NET и средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
BDU:2023-03339
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio и программной платформы Microsoft.NET, позволяющая нарушителю повысить свои привилегии
BDU:2023-03439
Уязвимость программных платформ Microsoft .NET Framework, .NET и средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостаточной проверкой входных данных, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-03440
Уязвимость программных платформ Microsoft .NET Framework, .NET и средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии
BDU:2023-03531
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio и программной платформы Microsoft.NET, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
BDU:2023-03789
Уязвимость программной платформы .NET и средства разработки программного обеспечения Microsoft Visual Studio, вызванная ошибками синхронизации при использовании общего ресурса, позволяющая нарушителю обойти существующие ограничения безопасности
BDU:2023-03790
Уязвимость программной платформы .NET и средства разработки программного обеспечения Microsoft Visual Studio, вызванная ошибками синхронизации при использовании общего ресурса, позволяющая нарушителю повысить свои привилегии
BDU:2023-04540
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio и программной платформы Microsoft.NET Framework, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-04615
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio, программной платформы Microsoft.NET, и программной платформы ASP.NET Core, позволяющая нарушителю получить доступ к конфиденциальной информации
BDU:2023-04621
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio, программной платформы Microsoft.NET, связанная с недостаточной проверкой входных данных, позволяющая нарушителю раскрыть защищаемую информацию
BDU:2023-05593
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
BDU:2023-05594
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
BDU:2023-05595
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
BDU:2023-05605
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
BDU:2023-06110
Уязвимость средства разработки программного обеспечения Microsoft Visual Studio, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-06559
Уязвимость реализации протокола HTTP/2, связанная с возможностью формирования потока запросов в рамках уже установленного сетевого соединения, без открытия новых сетевых соединений и без подтверждения получения пакетов, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-06639
Уязвимость реализации сетевого протокола QUIC операционной системы Windows, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-06839
Уязвимость реализации сетевого протокола QUIC операционной системы Windows, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-08244
Уязвимость программной платформы Microsoft .NET Framework, средства разработки программного обеспечения Microsoft Visual Studio, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии
BDU:2023-08245
Уязвимость программной платформы ASP.NET Core, связанная с ошибками в настройках безопасности, позволяющая нарушителю раскрыть защищаемую информацию
Modified: 2024-11-21
CVE-2023-24895
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-24897
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-24936
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
Modified: 2024-11-21
CVE-2023-28260
.NET DLL Hijacking Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-29331
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
Modified: 2024-11-21
CVE-2023-29337
NuGet Client Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-32032
.NET and Visual Studio Elevation of Privilege Vulnerability
Modified: 2024-11-21
CVE-2023-33126
.NET and Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-33127
.NET and Visual Studio Elevation of Privilege Vulnerability
Modified: 2024-11-21
CVE-2023-33128
.NET and Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-33135
.NET and Visual Studio Elevation of Privilege Vulnerability
Modified: 2025-01-01
CVE-2023-33170
ASP.NET and Visual Studio Security Feature Bypass Vulnerability
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVZVMMCCBBCSCPAW2CRQGOTKIHVFCMRO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O5CFOR6ID2HP45E7ZOGQNX76FPIWP7XR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TLWNIIA2I6YCYVCXYBPBRSZ3UH6KILTG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3VJRGNYJXGPF5LXUG3NL45QPK2UU6PL/
- ASP.NET and Visual Studio Security Feature Bypass Vulnerability
- ASP.NET and Visual Studio Security Feature Bypass Vulnerability
Modified: 2025-01-01
CVE-2023-35390
.NET and Visual Studio Remote Code Execution Vulnerability
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CL2L4WE5QRT7WEXANYXSKSU43APC5N2V/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWVZFKTLNMNKPZ755EMRYIA6GHFOWGKY/
- .NET and Visual Studio Remote Code Execution Vulnerability
- .NET and Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-35391
ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability
Modified: 2024-11-21
CVE-2023-36049
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
Modified: 2024-11-21
CVE-2023-36435
Microsoft QUIC Denial of Service Vulnerability
Modified: 2025-01-01
CVE-2023-36558
ASP.NET Core Security Feature Bypass Vulnerability
Modified: 2024-11-21
CVE-2023-36792
Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-36793
Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-36794
Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-36796
Visual Studio Remote Code Execution Vulnerability
Modified: 2024-11-21
CVE-2023-36799
.NET Core and Visual Studio Denial of Service Vulnerability
Modified: 2024-11-21
CVE-2023-38171
Microsoft QUIC Denial of Service Vulnerability
Modified: 2024-11-21
CVE-2023-38178
.NET Core and Visual Studio Denial of Service Vulnerability
Modified: 2025-03-08
CVE-2023-38180
.NET and Visual Studio Denial of Service Vulnerability
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CL2L4WE5QRT7WEXANYXSKSU43APC5N2V/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWVZFKTLNMNKPZ755EMRYIA6GHFOWGKY/
- .NET and Visual Studio Denial of Service Vulnerability
- .NET and Visual Studio Denial of Service Vulnerability
Modified: 2025-04-03
CVE-2023-44487
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
- [oss-security] 20231010 CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231010 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231018 Vulnerability in Jenkins
- [oss-security] 20231018 Vulnerability in Jenkins
- [oss-security] 20231018 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231018 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231019 CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST
- [oss-security] 20231019 CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST
- [oss-security] 20231020 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- [oss-security] 20231020 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
- https://access.redhat.com/security/cve/cve-2023-44487
- https://access.redhat.com/security/cve/cve-2023-44487
- https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/
- https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/
- https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
- https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
- https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
- https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
- https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/
- https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/
- https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack
- https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack
- https://blog.vespa.ai/cve-2023-44487/
- https://blog.vespa.ai/cve-2023-44487/
- https://bugzilla.proxmox.com/show_bug.cgi?id=4988
- https://bugzilla.proxmox.com/show_bug.cgi?id=4988
- https://bugzilla.redhat.com/show_bug.cgi?id=2242803
- https://bugzilla.redhat.com/show_bug.cgi?id=2242803
- https://bugzilla.suse.com/show_bug.cgi?id=1216123
- https://bugzilla.suse.com/show_bug.cgi?id=1216123
- https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9
- https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9
- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/
- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/
- https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
- https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
- https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125
- https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125
- https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715
- https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715
- https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve
- https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve
- https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
- https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
- https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088
- https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088
- https://github.com/advisories/GHSA-qppj-fm5r-hxr3
- https://github.com/advisories/GHSA-qppj-fm5r-hxr3
- https://github.com/advisories/GHSA-vx74-f528-fxqg
- https://github.com/advisories/GHSA-vx74-f528-fxqg
- https://github.com/advisories/GHSA-xpw8-rcwv-8f8p
- https://github.com/advisories/GHSA-xpw8-rcwv-8f8p
- https://github.com/akka/akka-http/issues/4323
- https://github.com/akka/akka-http/issues/4323
- https://github.com/alibaba/tengine/issues/1872
- https://github.com/alibaba/tengine/issues/1872
- https://github.com/apache/apisix/issues/10320
- https://github.com/apache/apisix/issues/10320
- https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113
- https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113
- https://github.com/apache/httpd-site/pull/10
- https://github.com/apache/httpd-site/pull/10
- https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2
- https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2
- https://github.com/apache/trafficserver/pull/10564
- https://github.com/apache/trafficserver/pull/10564
- https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487
- https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487
- https://github.com/Azure/AKS/issues/3947
- https://github.com/Azure/AKS/issues/3947
- https://github.com/bcdannyboy/CVE-2023-44487
- https://github.com/bcdannyboy/CVE-2023-44487
- https://github.com/caddyserver/caddy/issues/5877
- https://github.com/caddyserver/caddy/issues/5877
- https://github.com/caddyserver/caddy/releases/tag/v2.7.5
- https://github.com/caddyserver/caddy/releases/tag/v2.7.5
- https://github.com/dotnet/announcements/issues/277
- https://github.com/dotnet/announcements/issues/277
- https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73
- https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73
- https://github.com/eclipse/jetty.project/issues/10679
- https://github.com/eclipse/jetty.project/issues/10679
- https://github.com/envoyproxy/envoy/pull/30055
- https://github.com/envoyproxy/envoy/pull/30055
- https://github.com/etcd-io/etcd/issues/16740
- https://github.com/etcd-io/etcd/issues/16740
- https://github.com/facebook/proxygen/pull/466
- https://github.com/facebook/proxygen/pull/466
- https://github.com/golang/go/issues/63417
- https://github.com/golang/go/issues/63417
- https://github.com/grpc/grpc/releases/tag/v1.59.2
- https://github.com/grpc/grpc-go/pull/6703
- https://github.com/grpc/grpc-go/pull/6703
- https://github.com/h2o/h2o/pull/3291
- https://github.com/h2o/h2o/pull/3291
- https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf
- https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf
- https://github.com/haproxy/haproxy/issues/2312
- https://github.com/haproxy/haproxy/issues/2312
- https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244
- https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244
- https://github.com/junkurihara/rust-rpxy/issues/97
- https://github.com/junkurihara/rust-rpxy/issues/97
- https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1
- https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1
- https://github.com/kazu-yamamoto/http2/issues/93
- https://github.com/kazu-yamamoto/http2/issues/93
- https://github.com/Kong/kong/discussions/11741
- https://github.com/Kong/kong/discussions/11741
- https://github.com/kubernetes/kubernetes/pull/121120
- https://github.com/kubernetes/kubernetes/pull/121120
- https://github.com/line/armeria/pull/5232
- https://github.com/line/armeria/pull/5232
- https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632
- https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632
- https://github.com/micrictor/http2-rst-stream
- https://github.com/micrictor/http2-rst-stream
- https://github.com/microsoft/CBL-Mariner/pull/6381
- https://github.com/microsoft/CBL-Mariner/pull/6381
- https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
- https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
- https://github.com/nghttp2/nghttp2/pull/1961
- https://github.com/nghttp2/nghttp2/pull/1961
- https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
- https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
- https://github.com/ninenines/cowboy/issues/1615
- https://github.com/ninenines/cowboy/issues/1615
- https://github.com/nodejs/node/pull/50121
- https://github.com/nodejs/node/pull/50121
- https://github.com/openresty/openresty/issues/930
- https://github.com/openresty/openresty/issues/930
- https://github.com/opensearch-project/data-prepper/issues/3474
- https://github.com/opensearch-project/data-prepper/issues/3474
- https://github.com/oqtane/oqtane.framework/discussions/3367
- https://github.com/oqtane/oqtane.framework/discussions/3367
- https://github.com/projectcontour/contour/pull/5826
- https://github.com/projectcontour/contour/pull/5826
- https://github.com/tempesta-tech/tempesta/issues/1986
- https://github.com/tempesta-tech/tempesta/issues/1986
- https://github.com/varnishcache/varnish-cache/issues/3996
- https://github.com/varnishcache/varnish-cache/issues/3996
- https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
- https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
- https://istio.io/latest/news/security/istio-security-2023-004/
- https://istio.io/latest/news/security/istio-security-2023-004/
- https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/
- https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/
- https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q
- https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q
- [debian-lts-announce] 20231013 [SECURITY] [DLA 3617-1] tomcat9 security update
- [debian-lts-announce] 20231013 [SECURITY] [DLA 3617-1] tomcat9 security update
- [debian-lts-announce] 20231016 [SECURITY] [DLA 3621-1] nghttp2 security update
- [debian-lts-announce] 20231016 [SECURITY] [DLA 3621-1] nghttp2 security update
- [debian-lts-announce] 20231016 [SECURITY] [DLA 3617-2] tomcat9 regression update
- [debian-lts-announce] 20231016 [SECURITY] [DLA 3617-2] tomcat9 regression update
- [debian-lts-announce] 20231030 [SECURITY] [DLA 3641-1] jetty9 security update
- [debian-lts-announce] 20231030 [SECURITY] [DLA 3641-1] jetty9 security update
- [debian-lts-announce] 20231031 [SECURITY] [DLA 3638-1] h2o security update
- [debian-lts-announce] 20231031 [SECURITY] [DLA 3638-1] h2o security update
- [debian-lts-announce] 20231105 [SECURITY] [DLA 3645-1] trafficserver security update
- [debian-lts-announce] 20231105 [SECURITY] [DLA 3645-1] trafficserver security update
- [debian-lts-announce] 20231119 [SECURITY] [DLA 3656-1] netty security update
- [debian-lts-announce] 20231119 [SECURITY] [DLA 3656-1] netty security update
- FEDORA-2023-c0c6a91330
- FEDORA-2023-7b52921cae
- FEDORA-2023-0259c3f26f
- FEDORA-2023-4bf641255e
- FEDORA-2023-d5030c983c
- FEDORA-2023-4d2fd884ea
- FEDORA-2023-dbe64661af
- FEDORA-2023-5ff7bf1dd8
- FEDORA-2023-ed2642fd58
- FEDORA-2023-fe53e13b5b
- FEDORA-2023-f66fc0f62a
- FEDORA-2023-b2c50535cb
- FEDORA-2023-1caffb88af
- FEDORA-2023-3f70b8d406
- FEDORA-2023-492b7be466
- FEDORA-2023-17efd3f2cd
- FEDORA-2023-e9c04d81c1
- FEDORA-2023-822aab0a5a
- FEDORA-2023-7934802344
- FEDORA-2023-54fadada12
- FEDORA-2023-2a9214af5f
- FEDORA-2023-c0c6a91330
- FEDORA-2023-7b52921cae
- FEDORA-2023-0259c3f26f
- FEDORA-2023-4bf641255e
- FEDORA-2023-d5030c983c
- FEDORA-2023-4d2fd884ea
- FEDORA-2023-dbe64661af
- FEDORA-2023-5ff7bf1dd8
- FEDORA-2023-ed2642fd58
- FEDORA-2023-fe53e13b5b
- FEDORA-2023-f66fc0f62a
- FEDORA-2023-b2c50535cb
- FEDORA-2023-1caffb88af
- FEDORA-2023-3f70b8d406
- FEDORA-2023-492b7be466
- FEDORA-2023-17efd3f2cd
- FEDORA-2023-e9c04d81c1
- FEDORA-2023-822aab0a5a
- FEDORA-2023-7934802344
- FEDORA-2023-54fadada12
- FEDORA-2023-2a9214af5f
- https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html
- https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html
- https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html
- https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html
- https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html
- https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html
- https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/
- https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487
- https://my.f5.com/manage/s/article/K000137106
- https://my.f5.com/manage/s/article/K000137106
- https://netty.io/news/2023/10/10/4-1-100-Final.html
- https://netty.io/news/2023/10/10/4-1-100-Final.html
- https://news.ycombinator.com/item?id=37830987
- https://news.ycombinator.com/item?id=37830987
- https://news.ycombinator.com/item?id=37830998
- https://news.ycombinator.com/item?id=37830998
- https://news.ycombinator.com/item?id=37831062
- https://news.ycombinator.com/item?id=37831062
- https://news.ycombinator.com/item?id=37837043
- https://news.ycombinator.com/item?id=37837043
- https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/
- https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/
- https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected
- https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected
- GLSA-202311-09
- GLSA-202311-09
- https://security.netapp.com/advisory/ntap-20231016-0001/
- https://security.netapp.com/advisory/ntap-20231016-0001/
- https://security.netapp.com/advisory/ntap-20240426-0007/
- https://security.netapp.com/advisory/ntap-20240426-0007/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://security.netapp.com/advisory/ntap-20240621-0007/
- https://security.netapp.com/advisory/ntap-20240621-0007/
- https://security.paloaltonetworks.com/CVE-2023-44487
- https://security.paloaltonetworks.com/CVE-2023-44487
- https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14
- https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14
- https://ubuntu.com/security/CVE-2023-44487
- https://ubuntu.com/security/CVE-2023-44487
- https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/
- https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/
- https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
- https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
- https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event
- https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event
- DSA-5521
- DSA-5521
- DSA-5522
- DSA-5522
- DSA-5540
- DSA-5540
- DSA-5549
- DSA-5549
- DSA-5558
- DSA-5558
- DSA-5570
- DSA-5570
- https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487
- https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487
- https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/
- https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/
- https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
- https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
- https://www.openwall.com/lists/oss-security/2023/10/10/6
- https://www.openwall.com/lists/oss-security/2023/10/10/6
- https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack
- https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack
- https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/
- https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/
- https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause
Closed vulnerabilities
Modified: 2024-11-21
CVE-2022-30550
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
- https://dovecot.org/security
- https://dovecot.org/security
- [debian-lts-announce] 20220927 [SECURITY] [DLA 3122-1] dovecot security update
- [debian-lts-announce] 20220927 [SECURITY] [DLA 3122-1] dovecot security update
- GLSA-202310-19
- GLSA-202310-19
- https://www.dovecot.org/download/
- https://www.dovecot.org/download/
- https://www.openwall.com/lists/oss-security/2022/07/08/1
- https://www.openwall.com/lists/oss-security/2022/07/08/1
Closed bugs
При использовании утилиты, уведомление: Use of uninitialized value $platform in hash element at /usr/bin/inxi line 16284
Package kf5-kcalcore updated to version 5.115.0-alt1 for branch c10f2 in task 348654.
Closed bugs
korganizer зависает при переключении вида на "События"
Package kde5-grantlee-editor updated to version 23.08.5-alt2 for branch c10f2 in task 348654.
Closed bugs
Не работает кнопка Сохранить оформление в contactprintthemeeditor из kde5-grantlee-editor
Открывается пустой текстовый редактор для сохраненной темы в contactprintthemeeditor из kde5-grantlee-editor
Package kde5-kalarm updated to version 23.08.5-alt1 for branch c10f2 in task 348654.
Closed bugs
Некорректно показывается имя в kalarm при удалении календаря
Package kde5-zanshin updated to version 23.08.5-alt1 for branch c10f2 in task 348654.
Closed bugs
Segmentation fault у zanshin-migrator при запуске kde5-zanshin
Не работает смена языка интерфейса в kde5-zanshin
Closed bugs
Сломано обновление
Package openstack-nova updated to version 27.1.0-alt1.p10 for branch c10f2 in task 351073.
Closed vulnerabilities
BDU:2023-00689
Уязвимость сервиса блочного хранения данных Openstack Cinder, связанная с использованием файлов и каталогов, доступных внешним сторонам, позволяющая нарушителю раскрыть защищаемую информацию
Modified: 2024-11-21
CVE-2015-9543
An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is related to NovaProxyRequestHandlerBase.new_websocket_client in console/websocketproxy.py.
- [oss-security] 20200219 [OSSA-2020-001] Nova can leak consoleauth token into log files (CVE-2015-9543)
- [oss-security] 20200219 [OSSA-2020-001] Nova can leak consoleauth token into log files (CVE-2015-9543)
- https://launchpad.net/bugs/1492140
- https://launchpad.net/bugs/1492140
- https://review.opendev.org/220622
- https://review.opendev.org/220622
- https://security.openstack.org/ossa/OSSA-2020-001.html
- https://security.openstack.org/ossa/OSSA-2020-001.html
Modified: 2024-11-21
CVE-2020-17376
An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected.
Modified: 2024-11-21
CVE-2021-3654
A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
- https://bugs.launchpad.net/nova/+bug/1927677
- https://bugs.launchpad.net/nova/+bug/1927677
- https://bugs.python.org/issue32084
- https://bugs.python.org/issue32084
- https://bugzilla.redhat.com/show_bug.cgi?id=1961439
- https://bugzilla.redhat.com/show_bug.cgi?id=1961439
- https://opendev.org/openstack/nova/commit/04d48527b62a35d912f93bc75613a6cca606df66
- https://opendev.org/openstack/nova/commit/04d48527b62a35d912f93bc75613a6cca606df66
- https://opendev.org/openstack/nova/commit/8906552cfc2525a44251d4cf313ece61e57251eb
- https://opendev.org/openstack/nova/commit/8906552cfc2525a44251d4cf313ece61e57251eb
- GLSA-202305-02
- GLSA-202305-02
- https://security.openstack.org/ossa/OSSA-2021-002.html
- https://security.openstack.org/ossa/OSSA-2021-002.html
- https://www.openwall.com/lists/oss-security/2021/07/29/2
- https://www.openwall.com/lists/oss-security/2021/07/29/2
Modified: 2024-11-21
CVE-2022-37394
An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnic_type, creating an instance bound to that port, and then changing the vnic_type of the bound port to macvtap, an authenticated user may cause the compute service to fail to restart, resulting in a possible denial of service. Only Nova deployments configured with SR-IOV are affected.
- https://bugs.launchpad.net/ossa/+bug/1981813
- https://review.opendev.org/c/openstack/nova/+/849985
- https://review.opendev.org/c/openstack/nova/+/850003
- https://bugs.launchpad.net/ossa/+bug/1981813
- https://review.opendev.org/c/openstack/nova/+/850003
- https://review.opendev.org/c/openstack/nova/+/849985
Modified: 2025-03-31
CVE-2022-47951
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.
- https://launchpad.net/bugs/1996188
- https://launchpad.net/bugs/1996188
- [debian-lts-announce] 20230130 [SECURITY] [DLA 3300-1] glance security update
- [debian-lts-announce] 20230130 [SECURITY] [DLA 3300-1] glance security update
- [debian-lts-announce] 20230130 [SECURITY] [DLA 3301-1] cinder security update
- [debian-lts-announce] 20230130 [SECURITY] [DLA 3301-1] cinder security update
- [debian-lts-announce] 20230130 [SECURITY] [DLA 3302-1] nova security update
- [debian-lts-announce] 20230130 [SECURITY] [DLA 3302-1] nova security update
- https://security.openstack.org/ossa/OSSA-2023-002.html
- https://security.openstack.org/ossa/OSSA-2023-002.html
- DSA-5336
- DSA-5336
- DSA-5337
- DSA-5337
- DSA-5338
- DSA-5338
Package yandex-browser-stable updated to version 24.4.3.1111-alt1 for branch c10f2 in task 351146.
Closed vulnerabilities
BDU:2024-03604
Уязвимость компонента Visuals браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2024-03978
Уязвимость обработчика JavaScript-сценариев V8 браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-27
CVE-2024-4671
Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_9.html
- https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_9.html
- https://issues.chromium.org/issues/339266700
- https://issues.chromium.org/issues/339266700
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BWFSZNNWSQYDRYKNLBDGEXXKMBXDYQ3F/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BWFSZNNWSQYDRYKNLBDGEXXKMBXDYQ3F/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAWEKDQTHPN7NFEMLIWP7YMIZ2DHF36N/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAWEKDQTHPN7NFEMLIWP7YMIZ2DHF36N/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTSN22LNYXMWHVTYNOYQVOY7VDZFHENQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTSN22LNYXMWHVTYNOYQVOY7VDZFHENQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSUWM73ZCXTN62AT2REYQDD5ZKPFMDZD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSUWM73ZCXTN62AT2REYQDD5ZKPFMDZD/
Modified: 2024-11-27
CVE-2024-4947
Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_15.html
- https://issues.chromium.org/issues/340221135
- https://issues.chromium.org/issues/340221135
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTSN22LNYXMWHVTYNOYQVOY7VDZFHENQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTSN22LNYXMWHVTYNOYQVOY7VDZFHENQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSUWM73ZCXTN62AT2REYQDD5ZKPFMDZD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSUWM73ZCXTN62AT2REYQDD5ZKPFMDZD/