Поиск уязвимостей
Количество 12
Количество 12
BDU:2023-07171
Уязвимость веб-сервера Apache HTTP Server, связанная с блокировкой обработки соединения HTTP/2, позволяющая нарушителю вызвать отказ в обслуживании
ROS-20231030-05
Уязвимость Apache httpd
ALT-PU-2023-8842
ALT-PU-2023-8842: package `apache2` update to version 2.4.58-alt1
ALT-PU-2023-8586
ALT-PU-2023-8586: package `apache2` update to version 2.4.58-alt1
ROS-20240423-01
Множественные уязвимости varnish
CVE-2023-43622
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
CVE-2023-43622
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
CVE-2023-43622
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
CVE-2023-43622
Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
CVE-2023-43622
An attacker, opening a HTTP/2 connection with an initial window size o ...
GHSA-w2qc-22jv-44g8
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
ELSA-2024-2368
ELSA-2024-2368: mod_http2 security update (MODERATE)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2023-07171 Уязвимость веб-сервера Apache HTTP Server, связанная с блокировкой обработки соединения HTTP/2, позволяющая нарушителю вызвать отказ в обслуживании | CVSS3: 7.5 | 69% Средний | около 3 лет назад |
 | ROS-20231030-05 Уязвимость Apache httpd | CVSS3: 7.5 | 69% Средний | около 3 лет назад |
| ALT-PU-2023-8842 ALT-PU-2023-8842: package `apache2` update to version 2.4.58-alt1 | CVSS3: 7.5 | около 3 лет назад | |
| ALT-PU-2023-8586 ALT-PU-2023-8586: package `apache2` update to version 2.4.58-alt1 | CVSS3: 7.5 | около 3 лет назад | |
| ROS-20240423-01 Множественные уязвимости varnish | CVSS3: 7.5 | больше 2 лет назад | |
 | CVE-2023-43622 An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue. | CVSS3: 7.5 | 69% Средний | около 3 лет назад |
 | CVE-2023-43622 An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue. | CVSS3: 7.5 | 69% Средний | около 3 лет назад |
 | CVE-2023-43622 An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue. | CVSS3: 7.5 | 69% Средний | около 3 лет назад |
 | CVE-2023-43622 Apache HTTP Server: DoS in HTTP/2 with initial windows size 0 | CVSS3: 7.5 | 69% Средний | около 3 лет назад |
| CVE-2023-43622 An attacker, opening a HTTP/2 connection with an initial window size o ... | CVSS3: 7.5 | 69% Средний | около 3 лет назад |
| GHSA-w2qc-22jv-44g8 An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue. | CVSS3: 7.5 | 69% Средний | около 3 лет назад |
| ELSA-2024-2368 ELSA-2024-2368: mod_http2 security update (MODERATE) | больше 2 лет назад |
Уязвимостей на страницу