Skip to content
Fencer Intel
high 7.5

GHSA-9wmc-rg4h-28wv json

github.com/kumahq/kuma affected by CVE-2023-44487

published 3y ago modified last yr.

cvss
7.5
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact Envoy and Go HTTP/2 protocol stack is vulnerable to the "Rapid Reset" class of exploits, which send a sequence of HEADERS frames optionally followed by RST_STREAM frames.

This can be exercised if you use the builtin gateway and receive untrusted http2 traffic.

### Patches

https://github.com/kumahq/kuma/pull/8023 https://github.com/kumahq/kuma/pull/8001 https://github.com/kumahq/kuma/pull/8034

### Workarounds Disable http2 on the gateway listener with a MeshProxyPatch or ProxyTemplate.

### References https://github.com/advisories/GHSA-qppj-fm5r-hxr3 https://github.com/golang/go/issues/63417 https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76 https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/?sf269548684=1 https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge

Patch / fix

  • go github.com/kumahq/kuma 2.0.8, 2.1.8, 2.2.4, 2.3.3, 2.4.3

Is GHSA-9wmc-rg4h-28wv in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/kumahq/kuma
>=2.4.0, <2.4.3
>=2.3.0, <2.3.3
>=2.2.0, <2.2.4
>=2.1.0, <2.1.8
<2.0.8
2.4.3
2.3.3
2.2.4
2.1.8
2.0.8

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.