CVE-2023-45288

Public on 2024-04-04
Modified on 2024-04-05
Description

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

Severity
Medium
See what this means
CVSS v3 Base Score
5.3
See breakdown

Affected Packages

Platform Package Release Date Advisory
Amazon Linux 2 - Core amazon-cloudwatch-agent 2024-05-30 ALAS2-2024-2550
Amazon Linux 2023 amazon-cloudwatch-agent 2024-05-28 ALAS2023-2024-625
Amazon Linux 2 - Docker Extra amazon-ecr-credential-helper 2024-03-06 ALAS2DOCKER-2024-039
Amazon Linux 2023 amazon-ecr-credential-helper 2024-05-28 ALAS2023-2024-631
Amazon Linux 2 - Core amazon-ssm-agent 2024-10-02 ALAS2-2024-2645
Amazon Linux 2023 amazon-ssm-agent 2024-10-14 ALAS2023-2024-735
Amazon Linux 1 amazon-ssm-agent 2024-10-03 ALAS-2024-1948
Amazon Linux 2 - Core cni-plugins 2024-05-30 ALAS2-2024-2555
Amazon Linux 2023 cni-plugins 2024-05-28 ALAS2023-2024-630
Amazon Linux 2 - Core cri-tools 2024-06-12 ALAS2-2024-2568
Amazon Linux 2 - Ecs Extra ecs-init 2024-07-22 ALAS2ECS-2024-039
Amazon Linux 2 - Ecs Extra amazon-ecr-credential-helper 2024-05-30 ALAS2ECS-2024-036
Amazon Linux 2 - Aws-nitro-enclaves-cli Extra amazon-ecr-credential-helper 2024-05-30 ALAS2NITRO-ENCLAVES-2024-040
Amazon Linux 2023 ecs-init 2024-07-22 ALAS2023-2024-672
Amazon Linux 2 - Core golang 2024-05-30 ALAS2-2024-2554
Amazon Linux 2023 golang 2024-05-28 ALAS2023-2024-629
Amazon Linux 2 - Core golist 2024-05-30 ALAS2-2024-2556
Amazon Linux 2 - Core nerdctl 2024-08-06 ALAS2-2024-2618
Amazon Linux 2023 nerdctl 2024-08-15 ALAS2023-2024-700
Amazon Linux 2 - Docker Extra oci-add-hooks 2024-08-21 ALAS2DOCKER-2024-042
Amazon Linux 2 - Aws-nitro-enclaves-cli Extra oci-add-hooks 2024-08-21 ALAS2NITRO-ENCLAVES-2024-043
Amazon Linux 2023 oci-add-hooks 2024-05-28 ALAS2023-2024-632

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L