Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.5 release and security update

Fixed packages 32

Vulnerabilities 1

• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242803
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5783.json
• report
  https://access.redhat.com/security/cve/CVE-2023-44487
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-44487
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-44487
• article
  https://github.com/dotnet/announcements/issues/277
• advisory
  https://pkg.go.dev/vuln/GO-2023-2102
• article
  https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
• article
  https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog