CVE-2023-44487 impact

From Yocto Project
Revision as of 12:31, 20 October 2023 by Marta Rybczynska (talk | contribs) (Upate backpiort state)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigationJump to search

(WIP) CVE-2023-44487 (HTTP2 RapidReset issue)

This is a synchronization wiki page to coordinate work on CVE-2023-44487 (known as HTTP/2 Rapid Reset issue) impact in the Yocto Project. When you have new information, do not hesitate to update/add to this page.

OE-core

  • go

Status: Fixed (master)

Master version: 1.20.10 (fixed, commit 262d5386c6293dbd6b9c677fbb7ed7431651db5)

Nanbield version: Under analysis

Kirkstone version: 1.17.x, need backport

Dunfell version: Under analysis

Sources: https://go.dev/doc/devel/release#go1.20

  • lighthttpd

Status: not affected

Sources: https://redmine.lighttpd.net/boards/2/topics/11188

  • nghttpd2

Status: Fixed (master)

Master version: 1.57.0 (fixed commit c24b75f027f2609dac935e8981f2eb58394b1cc6)

Nanbield version: Under analysis

Kirkstone version: 1.47, need backport

Dunfell version: Under analysis

Sources: https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0

meta-openembedded

  • apache2

Status: Not affected

Sources: https://chaos.social/@icing/111210915918780532

  • ngnix

Status: Likely not affected, configuration check needed. We MIGHT want to include the hardening patch

Master version: Under analysis

Nanbield version: Under analysis

Kirkstone version: Under analysis

Dunfell version: Under analysis

Sources: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ and https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html

  • nodejs

Status: Affected, via a dependency on nghttpd2

Master version: 20.5.1, need update to 20.8.1, patch pending https://lists.openembedded.org/g/openembedded-devel/message/105567

Nanbield version: 20.5.1, need update to 20.8.1

Kirkstone version: Under analysis

Dunfell version: Under analysis

Sources: https://github.com/nodejs/node/pull/50121 and https://github.com/nodejs/node/releases

meta-java

  • tomcat

- Includes tomcat 5.5.26 which is outdated. No more analysis