Skip to content

Commit

Permalink
chore(deps): update ⬆️ gomod to v0.17.0 (#112)
Browse files Browse the repository at this point in the history
This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| golang.org/x/net | `v0.13.0` -> `v0.17.0` |
[![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/go/golang.org%2fx%2fnet/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/go/golang.org%2fx%2fnet/v0.13.0/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.13.0/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

#### [CVE-2023-39325](https://togithub.com/golang/go/issues/63417)

A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

####
[CVE-2023-44487](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)

## HTTP/2 Rapid reset attack
The HTTP/2 protocol allows clients to indicate to the server that a
previous stream should be canceled by sending a RST_STREAM frame. The
protocol does not require the client and server to coordinate the
cancellation in any way, the client may do it unilaterally. The client
may also assume that the cancellation will take effect immediately when
the server receives the RST_STREAM frame, before any other data from
that TCP connection is processed.

Abuse of this feature is called a Rapid Reset attack because it relies
on the ability for an endpoint to send a RST_STREAM frame immediately
after sending a request frame, which makes the other endpoint start
working and then rapidly resets the request. The request is canceled,
but leaves the HTTP/2 connection open.

The HTTP/2 Rapid Reset attack built on this capability is simple: The
client opens a large number of streams at once as in the standard HTTP/2
attack, but rather than waiting for a response to each request stream
from the server or proxy, the client cancels each request immediately.

The ability to reset streams immediately allows each connection to have
an indefinite number of requests in flight. By explicitly canceling the
requests, the attacker never exceeds the limit on the number of
concurrent open streams. The number of in-flight requests is no longer
dependent on the round-trip time (RTT), but only on the available
network bandwidth.

In a typical HTTP/2 server implementation, the server will still have to
do significant amounts of work for canceled requests, such as allocating
new stream data structures, parsing the query and doing header
decompression, and mapping the URL to a resource. For reverse proxy
implementations, the request may be proxied to the backend server before
the RST_STREAM frame is processed. The client on the other hand paid
almost no costs for sending the requests. This creates an exploitable
cost asymmetry between the server and the client.

Multiple software artifacts implementing HTTP/2 are affected. This
advisory was originally ingested from the `swift-nio-http2` repo
advisory and their original conent follows.

## swift-nio-http2 specific advisory
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

---

### HTTP/2 rapid reset can cause excessive work in net/http
BIT-golang-2023-39325 /
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/](https://lists.fedoraproject.org/archives/list/[email protected]/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/](https://lists.fedoraproject.org/archives/list/[email protected]/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/](https://lists.fedoraproject.org/archives/list/[email protected]/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/[email protected]/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/](https://lists.fedoraproject.org/archives/list/[email protected]/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/](https://lists.fedoraproject.org/archives/list/[email protected]/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/](https://lists.fedoraproject.org/archives/list/[email protected]/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/](https://lists.fedoraproject.org/archives/list/[email protected]/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/[email protected]/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/](https://lists.fedoraproject.org/archives/list/[email protected]/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/](https://lists.fedoraproject.org/archives/list/[email protected]/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/](https://lists.fedoraproject.org/archives/list/[email protected]/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/](https://lists.fedoraproject.org/archives/list/[email protected]/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/](https://lists.fedoraproject.org/archives/list/[email protected]/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/](https://lists.fedoraproject.org/archives/list/[email protected]/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/](https://lists.fedoraproject.org/archives/list/[email protected]/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/](https://lists.fedoraproject.org/archives/list/[email protected]/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/](https://lists.fedoraproject.org/archives/list/[email protected]/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/[email protected]/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/](https://lists.fedoraproject.org/archives/list/[email protected]/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/](https://lists.fedoraproject.org/archives/list/[email protected]/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/)
-
[https://pkg.go.dev/vuln/GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)
-
[https://security.gentoo.org/glsa/202311-09](https://security.gentoo.org/glsa/202311-09)
-
[https://security.netapp.com/advisory/ntap-20231110-0008/](https://security.netapp.com/advisory/ntap-20231110-0008/)
- [golang.org/x/net](golang.org/x/net)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-4374-p667-p6c8) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### HTTP/2 rapid reset can cause excessive work in net/http
BIT-golang-2023-39325 /
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
Unknown

#### References
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2023-2102) and the [Go
Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY
4.0](https://togithub.com/golang/vulndb#license)).
</details>

---

### HTTP/2 Stream Cancellation Attack
BIT-apisix-2023-44487 / BIT-aspnet-core-2023-44487 /
BIT-contour-2023-44487 / BIT-dotnet-2023-44487 /
BIT-dotnet-sdk-2023-44487 / BIT-envoy-2023-44487 / BIT-golang-2023-44487
/ BIT-jenkins-2023-44487 / BIT-kong-2023-44487 / BIT-nginx-2023-44487 /
BIT-nginx-ingress-controller-2023-44487 / BIT-node-2023-44487 /
BIT-solr-2023-44487 / BIT-tomcat-2023-44487 / BIT-varnish-2023-44487 /
[CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) /
[GHSA-2m7v-gc89-fjqf](https://togithub.com/advisories/GHSA-2m7v-gc89-fjqf)
/
[GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
/
[GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
/
[GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)

<details>
<summary>More information</summary>

#### Details
##### HTTP/2 Rapid reset attack
The HTTP/2 protocol allows clients to indicate to the server that a
previous stream should be canceled by sending a RST_STREAM frame. The
protocol does not require the client and server to coordinate the
cancellation in any way, the client may do it unilaterally. The client
may also assume that the cancellation will take effect immediately when
the server receives the RST_STREAM frame, before any other data from
that TCP connection is processed.

Abuse of this feature is called a Rapid Reset attack because it relies
on the ability for an endpoint to send a RST_STREAM frame immediately
after sending a request frame, which makes the other endpoint start
working and then rapidly resets the request. The request is canceled,
but leaves the HTTP/2 connection open.

The HTTP/2 Rapid Reset attack built on this capability is simple: The
client opens a large number of streams at once as in the standard HTTP/2
attack, but rather than waiting for a response to each request stream
from the server or proxy, the client cancels each request immediately.

The ability to reset streams immediately allows each connection to have
an indefinite number of requests in flight. By explicitly canceling the
requests, the attacker never exceeds the limit on the number of
concurrent open streams. The number of in-flight requests is no longer
dependent on the round-trip time (RTT), but only on the available
network bandwidth.

In a typical HTTP/2 server implementation, the server will still have to
do significant amounts of work for canceled requests, such as allocating
new stream data structures, parsing the query and doing header
decompression, and mapping the URL to a resource. For reverse proxy
implementations, the request may be proxied to the backend server before
the RST_STREAM frame is processed. The client on the other hand paid
almost no costs for sending the requests. This creates an exploitable
cost asymmetry between the server and the client.

Multiple software artifacts implementing HTTP/2 are affected. This
advisory was originally ingested from the `swift-nio-http2` repo
advisory and their original conent follows.

##### swift-nio-http2 specific advisory
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

#### References
-
[https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf](https://togithub.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf)
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487)
-
[https://github.com/Azure/AKS/issues/3947](https://togithub.com/Azure/AKS/issues/3947)
-
[https://github.com/akka/akka-http/issues/4323](https://togithub.com/akka/akka-http/issues/4323)
-
[https://github.com/alibaba/tengine/issues/1872](https://togithub.com/alibaba/tengine/issues/1872)
-
[https://github.com/apache/apisix/issues/10320](https://togithub.com/apache/apisix/issues/10320)
-
[https://github.com/caddyserver/caddy/issues/5877](https://togithub.com/caddyserver/caddy/issues/5877)
-
[https://github.com/dotnet/announcements/issues/277](https://togithub.com/dotnet/announcements/issues/277)
-
[https://github.com/eclipse/jetty.project/issues/10679](https://togithub.com/eclipse/jetty.project/issues/10679)
-
[https://github.com/etcd-io/etcd/issues/16740](https://togithub.com/etcd-io/etcd/issues/16740)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
-
[https://github.com/haproxy/haproxy/issues/2312](https://togithub.com/haproxy/haproxy/issues/2312)
-
[https://github.com/hyperium/hyper/issues/3337](https://togithub.com/hyperium/hyper/issues/3337)
-
[https://github.com/junkurihara/rust-rpxy/issues/97](https://togithub.com/junkurihara/rust-rpxy/issues/97)
-
[https://github.com/kazu-yamamoto/http2/issues/93](https://togithub.com/kazu-yamamoto/http2/issues/93)
-
[https://github.com/ninenines/cowboy/issues/1615](https://togithub.com/ninenines/cowboy/issues/1615)
-
[https://github.com/openresty/openresty/issues/930](https://togithub.com/openresty/openresty/issues/930)
-
[https://github.com/opensearch-project/data-prepper/issues/3474](https://togithub.com/opensearch-project/data-prepper/issues/3474)
-
[https://github.com/tempesta-tech/tempesta/issues/1986](https://togithub.com/tempesta-tech/tempesta/issues/1986)
-
[https://github.com/varnishcache/varnish-cache/issues/3996](https://togithub.com/varnishcache/varnish-cache/issues/3996)
-
[https://github.com/apache/httpd-site/pull/10](https://togithub.com/apache/httpd-site/pull/10)
-
[https://github.com/apache/trafficserver/pull/10564](https://togithub.com/apache/trafficserver/pull/10564)
-
[https://github.com/envoyproxy/envoy/pull/30055](https://togithub.com/envoyproxy/envoy/pull/30055)
-
[https://github.com/facebook/proxygen/pull/466](https://togithub.com/facebook/proxygen/pull/466)
-
[https://github.com/grpc/grpc-go/pull/6703](https://togithub.com/grpc/grpc-go/pull/6703)
-
[https://github.com/h2o/h2o/pull/3291](https://togithub.com/h2o/h2o/pull/3291)
-
[https://github.com/kubernetes/kubernetes/pull/121120](https://togithub.com/kubernetes/kubernetes/pull/121120)
-
[https://github.com/line/armeria/pull/5232](https://togithub.com/line/armeria/pull/5232)
-
[https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632](https://togithub.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632)
-
[https://github.com/microsoft/CBL-Mariner/pull/6381](https://togithub.com/microsoft/CBL-Mariner/pull/6381)
-
[https://github.com/nghttp2/nghttp2/pull/1961](https://togithub.com/nghttp2/nghttp2/pull/1961)
-
[https://github.com/nodejs/node/pull/50121](https://togithub.com/nodejs/node/pull/50121)
-
[https://github.com/projectcontour/contour/pull/5826](https://togithub.com/projectcontour/contour/pull/5826)
-
[https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1](https://togithub.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1)
-
[https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61](https://togithub.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61)
-
[https://access.redhat.com/security/cve/cve-2023-44487](https://access.redhat.com/security/cve/cve-2023-44487)
-
[https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/](https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/)
-
[https://aws.amazon.com/security/security-bulletins/AWS-2023-011/](https://aws.amazon.com/security/security-bulletins/AWS-2023-011/)
-
[https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/)
-
[https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/](https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/)
-
[https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/](https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/)
-
[https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack](https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack)
-
[https://blog.vespa.ai/cve-2023-44487/](https://blog.vespa.ai/cve-2023-44487/)
-
[https://bugzilla.proxmox.com/show_bug.cgi?id=4988](https://bugzilla.proxmox.com/show_bug.cgi?id=4988)
-
[https://bugzilla.redhat.com/show_bug.cgi?id=2242803](https://bugzilla.redhat.com/show_bug.cgi?id=2242803)
-
[https://bugzilla.suse.com/show_bug.cgi?id=1216123](https://bugzilla.suse.com/show_bug.cgi?id=1216123)
-
[https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9](https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9)
-
[https://chaos.social/@&#8203;icing/111210915918780532](https://chaos.social/@&#8203;icing/111210915918780532)
-
[https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/](https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/)
-
[https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack)
-
[https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125](https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125)
-
[https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715](https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715)
-
[https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve](https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve)
-
[https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764](https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764)
-
[https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088](https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088)
-
[https://github.com/Kong/kong/discussions/11741](https://togithub.com/Kong/kong/discussions/11741)
-
[https://github.com/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/advisories/GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
-
[https://github.com/advisories/GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)
-
[https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113](https://togithub.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113)
-
[https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2](https://togithub.com/apache/tomcat/tree/main/java/org/apache/coyote/http2)
-
[https://github.com/apple/swift-nio-http2](https://togithub.com/apple/swift-nio-http2)
-
[https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487](https://togithub.com/arkrwn/PoC/tree/main/CVE-2023-44487)
-
[https://github.com/bcdannyboy/CVE-2023-44487](https://togithub.com/bcdannyboy/CVE-2023-44487)
-
[https://github.com/caddyserver/caddy/releases/tag/v2.7.5](https://togithub.com/caddyserver/caddy/releases/tag/v2.7.5)
-
[https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73](https://togithub.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73)
-
[https://github.com/grpc/grpc-go/releases](https://togithub.com/grpc/grpc-go/releases)
-
[https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244](https://togithub.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244)
-
[https://github.com/micrictor/http2-rst-stream](https://togithub.com/micrictor/http2-rst-stream)
-
[https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0](https://togithub.com/nghttp2/nghttp2/releases/tag/v1.57.0)
-
[https://github.com/oqtane/oqtane.framework/discussions/3367](https://togithub.com/oqtane/oqtane.framework/discussions/3367)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://istio.io/latest/news/security/istio-security-2023-004/](https://istio.io/latest/news/security/istio-security-2023-004/)
-
[https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/](https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/)
-
[https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q](https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html)
-
[https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html)
-
[https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/](https://lists.fedoraproject.org/archives/list/[email protected]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/](https://lists.fedoraproject.org/archives/list/[email protected]/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/[email protected]/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/](https://lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/](https://lists.fedoraproject.org/archives/list/[email protected]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/](https://lists.fedoraproject.org/archives/list/[email protected]/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/](https://lists.fedoraproject.org/archives/list/[email protected]/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/[email protected]/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/[email protected]/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/](https://lists.fedoraproject.org/archives/list/[email protected]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/](https://lists.fedoraproject.org/archives/list/[email protected]/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/](https://lists.fedoraproject.org/archives/list/[email protected]/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/](https://lists.fedoraproject.org/archives/list/[email protected]/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/](https://lists.fedoraproject.org/archives/list/[email protected]/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/](https://lists.fedoraproject.org/archives/list/[email protected]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/[email protected]/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/](https://lists.fedoraproject.org/archives/list/[email protected]/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/](https://lists.fedoraproject.org/archives/list/[email protected]/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/](https://lists.fedoraproject.org/archives/list/[email protected]/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/)
-
[https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html](https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html)
-
[https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html](https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html)
-
[https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html](https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html)
-
[https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/](https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/)
-
[https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487)
-
[https://my.f5.com/manage/s/article/K000137106](https://my.f5.com/manage/s/article/K000137106)
-
[https://netty.io/news/2023/10/10/4-1-100-Final.html](https://netty.io/news/2023/10/10/4-1-100-Final.html)
-
[https://news.ycombinator.com/item?id=37830987](https://news.ycombinator.com/item?id=37830987)
-
[https://news.ycombinator.com/item?id=37830998](https://news.ycombinator.com/item?id=37830998)
-
[https://news.ycombinator.com/item?id=37831062](https://news.ycombinator.com/item?id=37831062)
-
[https://news.ycombinator.com/item?id=37837043](https://news.ycombinator.com/item?id=37837043)
-
[https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/](https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/)
-
[https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected](https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected)
-
[https://security.gentoo.org/glsa/202311-09](https://security.gentoo.org/glsa/202311-09)
-
[https://security.netapp.com/advisory/ntap-20231016-0001/](https://security.netapp.com/advisory/ntap-20231016-0001/)
-
[https://security.paloaltonetworks.com/CVE-2023-44487](https://security.paloaltonetworks.com/CVE-2023-44487)
-
[https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14](https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14)
-
[https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12](https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12)
-
[https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94](https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94)
-
[https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81](https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81)
-
[https://ubuntu.com/security/CVE-2023-44487](https://ubuntu.com/security/CVE-2023-44487)
-
[https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/](https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/)
-
[https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487](https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487)
-
[https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event](https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event)
-
[https://www.debian.org/security/2023/dsa-5521](https://www.debian.org/security/2023/dsa-5521)
-
[https://www.debian.org/security/2023/dsa-5522](https://www.debian.org/security/2023/dsa-5522)
-
[https://www.debian.org/security/2023/dsa-5540](https://www.debian.org/security/2023/dsa-5540)
-
[https://www.debian.org/security/2023/dsa-5549](https://www.debian.org/security/2023/dsa-5549)
-
[https://www.debian.org/security/2023/dsa-5558](https://www.debian.org/security/2023/dsa-5558)
-
[https://www.debian.org/security/2023/dsa-5570](https://www.debian.org/security/2023/dsa-5570)
-
[https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487](https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487)
-
[https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/](https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/)
-
[https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/](https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/)
-
[https://www.openwall.com/lists/oss-security/2023/10/10/6](https://www.openwall.com/lists/oss-security/2023/10/10/6)
-
[https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack](https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack)
-
[https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/](https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/4](http://www.openwall.com/lists/oss-security/2023/10/13/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/9](http://www.openwall.com/lists/oss-security/2023/10/13/9)
-
[http://www.openwall.com/lists/oss-security/2023/10/18/4](http://www.openwall.com/lists/oss-security/2023/10/18/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/18/8](http://www.openwall.com/lists/oss-security/2023/10/18/8)
-
[http://www.openwall.com/lists/oss-security/2023/10/19/6](http://www.openwall.com/lists/oss-security/2023/10/19/6)
-
[http://www.openwall.com/lists/oss-security/2023/10/20/8](http://www.openwall.com/lists/oss-security/2023/10/20/8)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-qppj-fm5r-hxr3) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy41Mi4wIiwidXBkYXRlZEluVmVyIjoiMzcuMTA4LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=-->

Co-authored-by: mend-for-github-com[bot] <50673670+mend-for-github-com[bot]@users.noreply.github.com>
  • Loading branch information
mend-for-github-com[bot] authored Jan 10, 2024
1 parent d4abaf1 commit 32db48f
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 12 deletions.
8 changes: 4 additions & 4 deletions go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -55,11 +55,11 @@ require (
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
github.com/ztrue/tracerr v0.3.0 // indirect
golang.org/x/mod v0.8.0 // indirect
golang.org/x/net v0.13.0 // indirect
golang.org/x/net v0.17.0 // indirect
golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b // indirect
golang.org/x/sys v0.10.0 // indirect
golang.org/x/term v0.10.0 // indirect
golang.org/x/text v0.11.0 // indirect
golang.org/x/sys v0.13.0 // indirect
golang.org/x/term v0.13.0 // indirect
golang.org/x/text v0.13.0 // indirect
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/protobuf v1.28.1 // indirect
Expand Down
16 changes: 8 additions & 8 deletions go.sum
Original file line number Diff line number Diff line change
Expand Up @@ -358,8 +358,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
golang.org/x/net v0.13.0 h1:Nvo8UFsZ8X3BhAC9699Z1j7XQ3rsZnUUm7jfBEk1ueY=
golang.org/x/net v0.13.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
Expand Down Expand Up @@ -416,14 +416,14 @@ golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBc
golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.10.0 h1:3R7pNqamzBraeqj/Tj8qt1aQ2HpmlC+Cx/qL/7hn4/c=
golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
Expand All @@ -432,8 +432,8 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4=
golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
Expand Down

0 comments on commit 32db48f

Please sign in to comment.