Bug 2245153 (CVE-2023-43622)

Summary:	CVE-2023-43622 httpd: mod_http2: DoS in HTTP/2 with initial window size 0
Product:	[Other] Security Response	Reporter:	Anten Skrabec <askrabec>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bdettelb, caswilli, csutherl, cy.schubert, gsuckevi, jclere, kaycoth, kyoshida, peholase, pjindal, plodge, szappis
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mod_http2 2.0.23	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the mod_http2 module of httpd. This flaw allows an attacker opening an HTTP/2 connection with an initial window size of 0 to block handling of that connection indefinitely. This vulnerability can exhaust worker resources in the server, similar to the well-known "slow loris" attack pattern.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2245323, 2245890
Bug Blocks:	2245154

Description Anten Skrabec 2023-10-19 19:27:30 UTC

An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern.

This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.
Users are recommended to upgrade to version 2.4.58, which fixes the issue.

References:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2023-43622
https://www.openwall.com/lists/oss-security/2023/10/19/5

Comment 2 msiddiqu 2023-10-20 10:41:52 UTC

References: 
 
https://httpd.apache.org/security/vulnerabilities_24.html

Comment 3 Guilherme de Almeida Suckevicz 2023-10-20 19:33:28 UTC

Created httpd tracking bugs for this issue:

Affects: fedora-all [bug 2245323]

Comment 4 Guilherme de Almeida Suckevicz 2023-10-24 13:50:56 UTC

Created mod_http2 tracking bugs for this issue:

Affects: fedora-all [bug 2245890]

Comment 8 errata-xmlrpc 2024-04-30 10:05:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2368 https://access.redhat.com/errata/RHSA-2024:2368