Summary
It was discovered that the .NET Kestrel web server did not properly handle
HTTP/2 requests. A remote attacker could possibly use this issue to cause a
denial of service.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | dotnet6 | 6.0.123-0ubuntu1~22.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | dotnet7 | 7.0.112-0ubuntu1~22.04.1 |
Vulnerabilities 1
-
High 7.5
HTTP/2 Stream Cancellation Attack
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
KEV Oct 10, 2023
References
-
report
https://ubuntu.com/security/CVE-2023-44487