Apache HTTP Server up to 2.4.57 HTTP/2 resource consumption

Summaryinfo

A vulnerability categorized as critical has been discovered in Apache HTTP Server up to 2.4.57. The impacted element is an unknown function of the component HTTP2 Handler. The manipulation results in resource consumption. This vulnerability is cataloged as CVE-2023-45802. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Apache HTTP Server up to 2.4.57 (Web Server). Affected is an unknown functionality of the component HTTP2 Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability.

The weakness was shared 10/19/2023. The advisory is shared for download at lists.apache.org. This vulnerability is traded as CVE-2023-45802 since 10/13/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 210708 (SUSE SLES12 Security Update : apache2 (SUSE-SU-2024:3949-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.4.58 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (210708) and CERT Bund (WID-SEC-2023-2712). Once again VulDB remains the best source for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat JBoss Core Services
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• IBM Rational ClearCase
• Oracle Linux
• IBM Rational ClearQuest
• IBM Power Hardware Management Console
• Dell NetWorker
• Apache HTTP Server
• IBM HTTP Server
• Xerox FreeFlow Print Server
• Open Source Varnish HTTP Cache
• IBM QRadar SIEM

Productinfo

Type

• Web Server

Vendor

• Apache

Name

• HTTP Server

Version

• 2.4.0
• 2.4.1
• 2.4.2
• 2.4.3
• 2.4.4
• 2.4.5
• 2.4.6
• 2.4.7
• 2.4.8
• 2.4.9
• 2.4.10
• 2.4.11
• 2.4.12
• 2.4.13
• 2.4.14
• 2.4.15
• 2.4.16
• 2.4.17
• 2.4.18
• 2.4.19
• 2.4.20
• 2.4.21
• 2.4.22
• 2.4.23
• 2.4.24
• 2.4.25
• 2.4.26
• 2.4.27
• 2.4.28
• 2.4.29
• 2.4.30
• 2.4.31
• 2.4.32
• 2.4.33
• 2.4.34
• 2.4.35
• 2.4.36
• 2.4.37
• 2.4.38
• 2.4.39
• 2.4.40
• 2.4.41
• 2.4.42
• 2.4.43
• 2.4.44
• 2.4.45
• 2.4.46
• 2.4.47
• 2.4.48
• 2.4.49
• 2.4.50
• 2.4.51
• 2.4.52
• 2.4.53
• 2.4.54
• 2.4.55
• 2.4.56
• 2.4.57

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion