Vulnerability-Lookup

RHBA-2024:2648

Vulnerability from csaf_redhat - Published: 2024-05-01 22:35 - Updated: 2026-08-14 10:32

Summary

Red Hat Bug Fix Advisory: LVMS 4.13.6 Bug Fix Update

Severity

Important

Notes

Topic: Updated container images that fix multiple bugs are now available for LVMS 4.13

Details: Logical Volume Manager Storage uses lvm2 through the TopoLVM CSI driver to dynamically provision thin and thick local storage on a cluster with limited resources. Users of LVMS are advised to upgrade to the latest version of LVMS in OpenShift Container Platform, which fixes bugs and security vulnerabilities.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-45288

A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service (DoS) attack.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 16 products

Product	Version	Remediation
Unresolved product id: 8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:49925f850770c4ccba59dbceb9ffe0d7c59e5acf7d0b54baf7b2dc7f1e9494de_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:878e2f7b4af26196d30faf110a667238addb4c67d039ccaa9196a45e45af127a_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:ad023433c7b4ce0ecd159db915236de9a3273b0bc24edfb31dbbafd8b9706bb1_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:ef2c80336249bf864d4ccab747f7097766f368a575e2e45645fa92bd19acfd60_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:2ce17ffcaa145ab476d367862c017a55e9cd4898c3f389906e6705ef992c1e1f_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:6698ed0920b36f2581438ab6000db8118c7be63407d644f64c644549f8ef019d_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:75039a8f5bd901b241105bd167f5bfcda4bf93046d44d407a0c4e0c3bc436680_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:af8e0eec77f039c81d68853d126042cf1d0d61db762f019ccc8a8f3145282435_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:1e572fe0d7b1aa06b315ce506b7342429fa13c3b76676fd77246ff153e3edd7a_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:395cdb02c412081da754cb3a54756da746e90296536caa8e9e560d2c461cd047_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:d5ac2b9aed11bfa60b02deb83f83f28702a9c5b8081003f05dbe47619e037a44_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:eae7d1853ab166c25f0af60543de5ad5c9a7b4ac48dba6b672a24451eeb1ac6f_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:462297cea11fb99476264faa8fef27b8f75045961080159550d5c88c5d1af7a4_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:6fff57b8fc3b932576742da3647c204b0b850f369ac38dc49c6b4785536d90dc_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:90def498de78fc8c8904ec48530389628c20f51a51fb62a8652dd2c2721de3e4_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:c43dd964a36d9b7c75aaf28cc19fdea81b0e85a802538d1fc146b29f23dd4240_s390x	—	Vendor Fix fix Workaround

Threats

Impact Important

References

9 references

URL	Category
https://access.redhat.com/errata/RHBA-2024:2648	self
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2023-45288	self
https://bugzilla.redhat.com/show_bug.cgi?id=2268273	external
https://www.cve.org/CVERecord?id=CVE-2023-45288	external
https://nvd.nist.gov/vuln/detail/CVE-2023-45288	external
https://nowotarski.info/http2-continuation-flood/	external
https://pkg.go.dev/vuln/GO-2024-2687	external
https://www.kb.cert.org/vuls/id/421644	external

Acknowledgments

nowotarski.info Bartek Nowotarski

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated container images that fix multiple bugs are now available for LVMS\n4.13",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Logical Volume Manager Storage uses lvm2 through the TopoLVM CSI driver to\ndynamically provision thin and thick local storage on a cluster with\nlimited resources.\n\nUsers of LVMS are advised to upgrade to the latest version of LVMS in\nOpenShift Container Platform, which fixes bugs and security\nvulnerabilities.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2024:2648",
        "url": "https://access.redhat.com/errata/RHBA-2024:2648"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_2648.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: LVMS 4.13.6 Bug Fix Update",
    "tracking": {
      "current_release_date": "2026-08-14T10:32:36+00:00",
      "generator": {
        "date": "2026-08-14T10:32:36+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.15"
        }
      },
      "id": "RHBA-2024:2648",
      "initial_release_date": "2024-05-01T22:35:00+00:00",
      "revision_history": [
        {
          "date": "2024-05-01T22:35:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-05-01T22:35:01+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-14T10:32:36+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "LVMS 4.13 for RHEL 8",
                "product": {
                  "name": "LVMS 4.13 for RHEL 8",
                  "product_id": "8Base-LVMS-4.13",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:lvms:4.13::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "logical volume manager storage"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "lvms4/lvms-must-gather-rhel8@sha256:878e2f7b4af26196d30faf110a667238addb4c67d039ccaa9196a45e45af127a_amd64",
                "product": {
                  "name": "lvms4/lvms-must-gather-rhel8@sha256:878e2f7b4af26196d30faf110a667238addb4c67d039ccaa9196a45e45af127a_amd64",
                  "product_id": "lvms4/lvms-must-gather-rhel8@sha256:878e2f7b4af26196d30faf110a667238addb4c67d039ccaa9196a45e45af127a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel8@sha256:878e2f7b4af26196d30faf110a667238addb4c67d039ccaa9196a45e45af127a?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel8\u0026tag=v4.13.6-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-operator-bundle@sha256:75039a8f5bd901b241105bd167f5bfcda4bf93046d44d407a0c4e0c3bc436680_amd64",
                "product": {
                  "name": "lvms4/lvms-operator-bundle@sha256:75039a8f5bd901b241105bd167f5bfcda4bf93046d44d407a0c4e0c3bc436680_amd64",
                  "product_id": "lvms4/lvms-operator-bundle@sha256:75039a8f5bd901b241105bd167f5bfcda4bf93046d44d407a0c4e0c3bc436680_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-operator-bundle@sha256:75039a8f5bd901b241105bd167f5bfcda4bf93046d44d407a0c4e0c3bc436680?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=v4.13.6-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-rhel8-operator@sha256:eae7d1853ab166c25f0af60543de5ad5c9a7b4ac48dba6b672a24451eeb1ac6f_amd64",
                "product": {
                  "name": "lvms4/lvms-rhel8-operator@sha256:eae7d1853ab166c25f0af60543de5ad5c9a7b4ac48dba6b672a24451eeb1ac6f_amd64",
                  "product_id": "lvms4/lvms-rhel8-operator@sha256:eae7d1853ab166c25f0af60543de5ad5c9a7b4ac48dba6b672a24451eeb1ac6f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel8-operator@sha256:eae7d1853ab166c25f0af60543de5ad5c9a7b4ac48dba6b672a24451eeb1ac6f?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel8-operator\u0026tag=v4.13.6-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/topolvm-rhel8@sha256:6fff57b8fc3b932576742da3647c204b0b850f369ac38dc49c6b4785536d90dc_amd64",
                "product": {
                  "name": "lvms4/topolvm-rhel8@sha256:6fff57b8fc3b932576742da3647c204b0b850f369ac38dc49c6b4785536d90dc_amd64",
                  "product_id": "lvms4/topolvm-rhel8@sha256:6fff57b8fc3b932576742da3647c204b0b850f369ac38dc49c6b4785536d90dc_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topolvm-rhel8@sha256:6fff57b8fc3b932576742da3647c204b0b850f369ac38dc49c6b4785536d90dc?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel8\u0026tag=v4.13.6-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "lvms4/lvms-must-gather-rhel8@sha256:ef2c80336249bf864d4ccab747f7097766f368a575e2e45645fa92bd19acfd60_arm64",
                "product": {
                  "name": "lvms4/lvms-must-gather-rhel8@sha256:ef2c80336249bf864d4ccab747f7097766f368a575e2e45645fa92bd19acfd60_arm64",
                  "product_id": "lvms4/lvms-must-gather-rhel8@sha256:ef2c80336249bf864d4ccab747f7097766f368a575e2e45645fa92bd19acfd60_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel8@sha256:ef2c80336249bf864d4ccab747f7097766f368a575e2e45645fa92bd19acfd60?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel8\u0026tag=v4.13.6-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-operator-bundle@sha256:2ce17ffcaa145ab476d367862c017a55e9cd4898c3f389906e6705ef992c1e1f_arm64",
                "product": {
                  "name": "lvms4/lvms-operator-bundle@sha256:2ce17ffcaa145ab476d367862c017a55e9cd4898c3f389906e6705ef992c1e1f_arm64",
                  "product_id": "lvms4/lvms-operator-bundle@sha256:2ce17ffcaa145ab476d367862c017a55e9cd4898c3f389906e6705ef992c1e1f_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-operator-bundle@sha256:2ce17ffcaa145ab476d367862c017a55e9cd4898c3f389906e6705ef992c1e1f?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=v4.13.6-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-rhel8-operator@sha256:1e572fe0d7b1aa06b315ce506b7342429fa13c3b76676fd77246ff153e3edd7a_arm64",
                "product": {
                  "name": "lvms4/lvms-rhel8-operator@sha256:1e572fe0d7b1aa06b315ce506b7342429fa13c3b76676fd77246ff153e3edd7a_arm64",
                  "product_id": "lvms4/lvms-rhel8-operator@sha256:1e572fe0d7b1aa06b315ce506b7342429fa13c3b76676fd77246ff153e3edd7a_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel8-operator@sha256:1e572fe0d7b1aa06b315ce506b7342429fa13c3b76676fd77246ff153e3edd7a?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel8-operator\u0026tag=v4.13.6-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/topolvm-rhel8@sha256:462297cea11fb99476264faa8fef27b8f75045961080159550d5c88c5d1af7a4_arm64",
                "product": {
                  "name": "lvms4/topolvm-rhel8@sha256:462297cea11fb99476264faa8fef27b8f75045961080159550d5c88c5d1af7a4_arm64",
                  "product_id": "lvms4/topolvm-rhel8@sha256:462297cea11fb99476264faa8fef27b8f75045961080159550d5c88c5d1af7a4_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topolvm-rhel8@sha256:462297cea11fb99476264faa8fef27b8f75045961080159550d5c88c5d1af7a4?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel8\u0026tag=v4.13.6-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "lvms4/lvms-must-gather-rhel8@sha256:49925f850770c4ccba59dbceb9ffe0d7c59e5acf7d0b54baf7b2dc7f1e9494de_ppc64le",
                "product": {
                  "name": "lvms4/lvms-must-gather-rhel8@sha256:49925f850770c4ccba59dbceb9ffe0d7c59e5acf7d0b54baf7b2dc7f1e9494de_ppc64le",
                  "product_id": "lvms4/lvms-must-gather-rhel8@sha256:49925f850770c4ccba59dbceb9ffe0d7c59e5acf7d0b54baf7b2dc7f1e9494de_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel8@sha256:49925f850770c4ccba59dbceb9ffe0d7c59e5acf7d0b54baf7b2dc7f1e9494de?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel8\u0026tag=v4.13.6-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-operator-bundle@sha256:6698ed0920b36f2581438ab6000db8118c7be63407d644f64c644549f8ef019d_ppc64le",
                "product": {
                  "name": "lvms4/lvms-operator-bundle@sha256:6698ed0920b36f2581438ab6000db8118c7be63407d644f64c644549f8ef019d_ppc64le",
                  "product_id": "lvms4/lvms-operator-bundle@sha256:6698ed0920b36f2581438ab6000db8118c7be63407d644f64c644549f8ef019d_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-operator-bundle@sha256:6698ed0920b36f2581438ab6000db8118c7be63407d644f64c644549f8ef019d?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=v4.13.6-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-rhel8-operator@sha256:395cdb02c412081da754cb3a54756da746e90296536caa8e9e560d2c461cd047_ppc64le",
                "product": {
                  "name": "lvms4/lvms-rhel8-operator@sha256:395cdb02c412081da754cb3a54756da746e90296536caa8e9e560d2c461cd047_ppc64le",
                  "product_id": "lvms4/lvms-rhel8-operator@sha256:395cdb02c412081da754cb3a54756da746e90296536caa8e9e560d2c461cd047_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel8-operator@sha256:395cdb02c412081da754cb3a54756da746e90296536caa8e9e560d2c461cd047?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel8-operator\u0026tag=v4.13.6-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/topolvm-rhel8@sha256:90def498de78fc8c8904ec48530389628c20f51a51fb62a8652dd2c2721de3e4_ppc64le",
                "product": {
                  "name": "lvms4/topolvm-rhel8@sha256:90def498de78fc8c8904ec48530389628c20f51a51fb62a8652dd2c2721de3e4_ppc64le",
                  "product_id": "lvms4/topolvm-rhel8@sha256:90def498de78fc8c8904ec48530389628c20f51a51fb62a8652dd2c2721de3e4_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topolvm-rhel8@sha256:90def498de78fc8c8904ec48530389628c20f51a51fb62a8652dd2c2721de3e4?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel8\u0026tag=v4.13.6-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "lvms4/lvms-must-gather-rhel8@sha256:ad023433c7b4ce0ecd159db915236de9a3273b0bc24edfb31dbbafd8b9706bb1_s390x",
                "product": {
                  "name": "lvms4/lvms-must-gather-rhel8@sha256:ad023433c7b4ce0ecd159db915236de9a3273b0bc24edfb31dbbafd8b9706bb1_s390x",
                  "product_id": "lvms4/lvms-must-gather-rhel8@sha256:ad023433c7b4ce0ecd159db915236de9a3273b0bc24edfb31dbbafd8b9706bb1_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel8@sha256:ad023433c7b4ce0ecd159db915236de9a3273b0bc24edfb31dbbafd8b9706bb1?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel8\u0026tag=v4.13.6-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-operator-bundle@sha256:af8e0eec77f039c81d68853d126042cf1d0d61db762f019ccc8a8f3145282435_s390x",
                "product": {
                  "name": "lvms4/lvms-operator-bundle@sha256:af8e0eec77f039c81d68853d126042cf1d0d61db762f019ccc8a8f3145282435_s390x",
                  "product_id": "lvms4/lvms-operator-bundle@sha256:af8e0eec77f039c81d68853d126042cf1d0d61db762f019ccc8a8f3145282435_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-operator-bundle@sha256:af8e0eec77f039c81d68853d126042cf1d0d61db762f019ccc8a8f3145282435?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=v4.13.6-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-rhel8-operator@sha256:d5ac2b9aed11bfa60b02deb83f83f28702a9c5b8081003f05dbe47619e037a44_s390x",
                "product": {
                  "name": "lvms4/lvms-rhel8-operator@sha256:d5ac2b9aed11bfa60b02deb83f83f28702a9c5b8081003f05dbe47619e037a44_s390x",
                  "product_id": "lvms4/lvms-rhel8-operator@sha256:d5ac2b9aed11bfa60b02deb83f83f28702a9c5b8081003f05dbe47619e037a44_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel8-operator@sha256:d5ac2b9aed11bfa60b02deb83f83f28702a9c5b8081003f05dbe47619e037a44?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel8-operator\u0026tag=v4.13.6-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/topolvm-rhel8@sha256:c43dd964a36d9b7c75aaf28cc19fdea81b0e85a802538d1fc146b29f23dd4240_s390x",
                "product": {
                  "name": "lvms4/topolvm-rhel8@sha256:c43dd964a36d9b7c75aaf28cc19fdea81b0e85a802538d1fc146b29f23dd4240_s390x",
                  "product_id": "lvms4/topolvm-rhel8@sha256:c43dd964a36d9b7c75aaf28cc19fdea81b0e85a802538d1fc146b29f23dd4240_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topolvm-rhel8@sha256:c43dd964a36d9b7c75aaf28cc19fdea81b0e85a802538d1fc146b29f23dd4240?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel8\u0026tag=v4.13.6-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-must-gather-rhel8@sha256:49925f850770c4ccba59dbceb9ffe0d7c59e5acf7d0b54baf7b2dc7f1e9494de_ppc64le as a component of LVMS 4.13 for RHEL 8",
          "product_id": "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:49925f850770c4ccba59dbceb9ffe0d7c59e5acf7d0b54baf7b2dc7f1e9494de_ppc64le"
        },
        "product_reference": "lvms4/lvms-must-gather-rhel8@sha256:49925f850770c4ccba59dbceb9ffe0d7c59e5acf7d0b54baf7b2dc7f1e9494de_ppc64le",
        "relates_to_product_reference": "8Base-LVMS-4.13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-must-gather-rhel8@sha256:878e2f7b4af26196d30faf110a667238addb4c67d039ccaa9196a45e45af127a_amd64 as a component of LVMS 4.13 for RHEL 8",
          "product_id": "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:878e2f7b4af26196d30faf110a667238addb4c67d039ccaa9196a45e45af127a_amd64"
        },
        "product_reference": "lvms4/lvms-must-gather-rhel8@sha256:878e2f7b4af26196d30faf110a667238addb4c67d039ccaa9196a45e45af127a_amd64",
        "relates_to_product_reference": "8Base-LVMS-4.13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-must-gather-rhel8@sha256:ad023433c7b4ce0ecd159db915236de9a3273b0bc24edfb31dbbafd8b9706bb1_s390x as a component of LVMS 4.13 for RHEL 8",
          "product_id": "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:ad023433c7b4ce0ecd159db915236de9a3273b0bc24edfb31dbbafd8b9706bb1_s390x"
        },
        "product_reference": "lvms4/lvms-must-gather-rhel8@sha256:ad023433c7b4ce0ecd159db915236de9a3273b0bc24edfb31dbbafd8b9706bb1_s390x",
        "relates_to_product_reference": "8Base-LVMS-4.13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-must-gather-rhel8@sha256:ef2c80336249bf864d4ccab747f7097766f368a575e2e45645fa92bd19acfd60_arm64 as a component of LVMS 4.13 for RHEL 8",
          "product_id": "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:ef2c80336249bf864d4ccab747f7097766f368a575e2e45645fa92bd19acfd60_arm64"
        },
        "product_reference": "lvms4/lvms-must-gather-rhel8@sha256:ef2c80336249bf864d4ccab747f7097766f368a575e2e45645fa92bd19acfd60_arm64",
        "relates_to_product_reference": "8Base-LVMS-4.13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-operator-bundle@sha256:2ce17ffcaa145ab476d367862c017a55e9cd4898c3f389906e6705ef992c1e1f_arm64 as a component of LVMS 4.13 for RHEL 8",
          "product_id": "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:2ce17ffcaa145ab476d367862c017a55e9cd4898c3f389906e6705ef992c1e1f_arm64"
        },
        "product_reference": "lvms4/lvms-operator-bundle@sha256:2ce17ffcaa145ab476d367862c017a55e9cd4898c3f389906e6705ef992c1e1f_arm64",
        "relates_to_product_reference": "8Base-LVMS-4.13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-operator-bundle@sha256:6698ed0920b36f2581438ab6000db8118c7be63407d644f64c644549f8ef019d_ppc64le as a component of LVMS 4.13 for RHEL 8",
          "product_id": "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:6698ed0920b36f2581438ab6000db8118c7be63407d644f64c644549f8ef019d_ppc64le"
        },
        "product_reference": "lvms4/lvms-operator-bundle@sha256:6698ed0920b36f2581438ab6000db8118c7be63407d644f64c644549f8ef019d_ppc64le",
        "relates_to_product_reference": "8Base-LVMS-4.13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-operator-bundle@sha256:75039a8f5bd901b241105bd167f5bfcda4bf93046d44d407a0c4e0c3bc436680_amd64 as a component of LVMS 4.13 for RHEL 8",
          "product_id": "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:75039a8f5bd901b241105bd167f5bfcda4bf93046d44d407a0c4e0c3bc436680_amd64"
        },
        "product_reference": "lvms4/lvms-operator-bundle@sha256:75039a8f5bd901b241105bd167f5bfcda4bf93046d44d407a0c4e0c3bc436680_amd64",
        "relates_to_product_reference": "8Base-LVMS-4.13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-operator-bundle@sha256:af8e0eec77f039c81d68853d126042cf1d0d61db762f019ccc8a8f3145282435_s390x as a component of LVMS 4.13 for RHEL 8",
          "product_id": "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:af8e0eec77f039c81d68853d126042cf1d0d61db762f019ccc8a8f3145282435_s390x"
        },
        "product_reference": "lvms4/lvms-operator-bundle@sha256:af8e0eec77f039c81d68853d126042cf1d0d61db762f019ccc8a8f3145282435_s390x",
        "relates_to_product_reference": "8Base-LVMS-4.13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-rhel8-operator@sha256:1e572fe0d7b1aa06b315ce506b7342429fa13c3b76676fd77246ff153e3edd7a_arm64 as a component of LVMS 4.13 for RHEL 8",
          "product_id": "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:1e572fe0d7b1aa06b315ce506b7342429fa13c3b76676fd77246ff153e3edd7a_arm64"
        },
        "product_reference": "lvms4/lvms-rhel8-operator@sha256:1e572fe0d7b1aa06b315ce506b7342429fa13c3b76676fd77246ff153e3edd7a_arm64",
        "relates_to_product_reference": "8Base-LVMS-4.13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-rhel8-operator@sha256:395cdb02c412081da754cb3a54756da746e90296536caa8e9e560d2c461cd047_ppc64le as a component of LVMS 4.13 for RHEL 8",
          "product_id": "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:395cdb02c412081da754cb3a54756da746e90296536caa8e9e560d2c461cd047_ppc64le"
        },
        "product_reference": "lvms4/lvms-rhel8-operator@sha256:395cdb02c412081da754cb3a54756da746e90296536caa8e9e560d2c461cd047_ppc64le",
        "relates_to_product_reference": "8Base-LVMS-4.13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-rhel8-operator@sha256:d5ac2b9aed11bfa60b02deb83f83f28702a9c5b8081003f05dbe47619e037a44_s390x as a component of LVMS 4.13 for RHEL 8",
          "product_id": "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:d5ac2b9aed11bfa60b02deb83f83f28702a9c5b8081003f05dbe47619e037a44_s390x"
        },
        "product_reference": "lvms4/lvms-rhel8-operator@sha256:d5ac2b9aed11bfa60b02deb83f83f28702a9c5b8081003f05dbe47619e037a44_s390x",
        "relates_to_product_reference": "8Base-LVMS-4.13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-rhel8-operator@sha256:eae7d1853ab166c25f0af60543de5ad5c9a7b4ac48dba6b672a24451eeb1ac6f_amd64 as a component of LVMS 4.13 for RHEL 8",
          "product_id": "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:eae7d1853ab166c25f0af60543de5ad5c9a7b4ac48dba6b672a24451eeb1ac6f_amd64"
        },
        "product_reference": "lvms4/lvms-rhel8-operator@sha256:eae7d1853ab166c25f0af60543de5ad5c9a7b4ac48dba6b672a24451eeb1ac6f_amd64",
        "relates_to_product_reference": "8Base-LVMS-4.13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/topolvm-rhel8@sha256:462297cea11fb99476264faa8fef27b8f75045961080159550d5c88c5d1af7a4_arm64 as a component of LVMS 4.13 for RHEL 8",
          "product_id": "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:462297cea11fb99476264faa8fef27b8f75045961080159550d5c88c5d1af7a4_arm64"
        },
        "product_reference": "lvms4/topolvm-rhel8@sha256:462297cea11fb99476264faa8fef27b8f75045961080159550d5c88c5d1af7a4_arm64",
        "relates_to_product_reference": "8Base-LVMS-4.13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/topolvm-rhel8@sha256:6fff57b8fc3b932576742da3647c204b0b850f369ac38dc49c6b4785536d90dc_amd64 as a component of LVMS 4.13 for RHEL 8",
          "product_id": "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:6fff57b8fc3b932576742da3647c204b0b850f369ac38dc49c6b4785536d90dc_amd64"
        },
        "product_reference": "lvms4/topolvm-rhel8@sha256:6fff57b8fc3b932576742da3647c204b0b850f369ac38dc49c6b4785536d90dc_amd64",
        "relates_to_product_reference": "8Base-LVMS-4.13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/topolvm-rhel8@sha256:90def498de78fc8c8904ec48530389628c20f51a51fb62a8652dd2c2721de3e4_ppc64le as a component of LVMS 4.13 for RHEL 8",
          "product_id": "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:90def498de78fc8c8904ec48530389628c20f51a51fb62a8652dd2c2721de3e4_ppc64le"
        },
        "product_reference": "lvms4/topolvm-rhel8@sha256:90def498de78fc8c8904ec48530389628c20f51a51fb62a8652dd2c2721de3e4_ppc64le",
        "relates_to_product_reference": "8Base-LVMS-4.13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/topolvm-rhel8@sha256:c43dd964a36d9b7c75aaf28cc19fdea81b0e85a802538d1fc146b29f23dd4240_s390x as a component of LVMS 4.13 for RHEL 8",
          "product_id": "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:c43dd964a36d9b7c75aaf28cc19fdea81b0e85a802538d1fc146b29f23dd4240_s390x"
        },
        "product_reference": "lvms4/topolvm-rhel8@sha256:c43dd964a36d9b7c75aaf28cc19fdea81b0e85a802538d1fc146b29f23dd4240_s390x",
        "relates_to_product_reference": "8Base-LVMS-4.13"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Bartek Nowotarski"
          ],
          "organization": "nowotarski.info"
        }
      ],
      "cve": "CVE-2023-45288",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-03-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2268273"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service (DoS) attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates the security impact of this vulnerability as Important due to the worst case scenario resulting in a denial of service. It is simple to exploit, could significantly impact availability, and there is not a suitable mitigation for all use cases. Once an attack has ended, the system should return to normal operations on its own.\n\nThis vulnerability only impacts servers which have HTTP/2 enabled. It stems from an imperfect definition of the protocol. As the Go programming language is widely utilized across nearly every major Red Hat offering, a full listing of impacted packages will not be provided. Therefore, the \u201cAffected Packages and Issued Red Hat Security Errata\u201d section contains a simplified list of what offerings need to remediate this vulnerability. Every impacted offering has at least one representative component listed, but potentially not all of them. Rest assured that Red Hat is committed to remediating this vulnerability across our entire portfolio.\n\nMany components are rated as Low impact due to configurations which reduce the attack surface or  significantly increase the difficulty of exploitation. A summary of these scenarios are:\n* The container includes a package that provides a vulnerable webserver, but it is not used or running during operation\n* HTTP/2 is disabled by default and is not supported\n* Only a client implementation is provided, which is not vulnerable\n* A vulnerable module (either golang.org/net/http or golang.org/x/net/http2) is included, but disabled\n* Access to a vulnerable server is restricted within the container (loopback only connections)\n* Golang is available in the container but is not used\n\n\nWithin the Red Hat OpenShift Container Platform, the majority of vulnerable components are not externally accessible. This means an attacker must already have access to a container within your environment to exploit this vulnerability. However, the ose-hyperkube (openshift-enterprise-hyperkube) container is externally accessible, so there are less barriers to exploitation. Fixes for this specific container are already available.\n\nWithin Red Hat Ansible Automation Platform, the impacted component is Receptor. The impact has been reduced to Low as the vulnerable code is present, but not utilized. There are three potential exposures within this component:\n* Receptor utilizes QUIC a UDP based protocol which does not run over HTTP/2\n* Receptor utilizes the x/net/ipv4 and ipv6 packages, both of which are not affected",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:49925f850770c4ccba59dbceb9ffe0d7c59e5acf7d0b54baf7b2dc7f1e9494de_ppc64le",
          "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:878e2f7b4af26196d30faf110a667238addb4c67d039ccaa9196a45e45af127a_amd64",
          "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:ad023433c7b4ce0ecd159db915236de9a3273b0bc24edfb31dbbafd8b9706bb1_s390x",
          "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:ef2c80336249bf864d4ccab747f7097766f368a575e2e45645fa92bd19acfd60_arm64",
          "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:2ce17ffcaa145ab476d367862c017a55e9cd4898c3f389906e6705ef992c1e1f_arm64",
          "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:6698ed0920b36f2581438ab6000db8118c7be63407d644f64c644549f8ef019d_ppc64le",
          "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:75039a8f5bd901b241105bd167f5bfcda4bf93046d44d407a0c4e0c3bc436680_amd64",
          "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:af8e0eec77f039c81d68853d126042cf1d0d61db762f019ccc8a8f3145282435_s390x",
          "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:1e572fe0d7b1aa06b315ce506b7342429fa13c3b76676fd77246ff153e3edd7a_arm64",
          "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:395cdb02c412081da754cb3a54756da746e90296536caa8e9e560d2c461cd047_ppc64le",
          "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:d5ac2b9aed11bfa60b02deb83f83f28702a9c5b8081003f05dbe47619e037a44_s390x",
          "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:eae7d1853ab166c25f0af60543de5ad5c9a7b4ac48dba6b672a24451eeb1ac6f_amd64",
          "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:462297cea11fb99476264faa8fef27b8f75045961080159550d5c88c5d1af7a4_arm64",
          "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:6fff57b8fc3b932576742da3647c204b0b850f369ac38dc49c6b4785536d90dc_amd64",
          "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:90def498de78fc8c8904ec48530389628c20f51a51fb62a8652dd2c2721de3e4_ppc64le",
          "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:c43dd964a36d9b7c75aaf28cc19fdea81b0e85a802538d1fc146b29f23dd4240_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-45288"
        },
        {
          "category": "external",
          "summary": "RHBZ#2268273",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268273"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-45288",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-45288"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-45288",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45288"
        },
        {
          "category": "external",
          "summary": "https://nowotarski.info/http2-continuation-flood/",
          "url": "https://nowotarski.info/http2-continuation-flood/"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-2687",
          "url": "https://pkg.go.dev/vuln/GO-2024-2687"
        },
        {
          "category": "external",
          "summary": "https://www.kb.cert.org/vuls/id/421644",
          "url": "https://www.kb.cert.org/vuls/id/421644"
        }
      ],
      "release_date": "2024-04-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-05-01T22:35:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:49925f850770c4ccba59dbceb9ffe0d7c59e5acf7d0b54baf7b2dc7f1e9494de_ppc64le",
            "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:878e2f7b4af26196d30faf110a667238addb4c67d039ccaa9196a45e45af127a_amd64",
            "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:ad023433c7b4ce0ecd159db915236de9a3273b0bc24edfb31dbbafd8b9706bb1_s390x",
            "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:ef2c80336249bf864d4ccab747f7097766f368a575e2e45645fa92bd19acfd60_arm64",
            "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:2ce17ffcaa145ab476d367862c017a55e9cd4898c3f389906e6705ef992c1e1f_arm64",
            "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:6698ed0920b36f2581438ab6000db8118c7be63407d644f64c644549f8ef019d_ppc64le",
            "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:75039a8f5bd901b241105bd167f5bfcda4bf93046d44d407a0c4e0c3bc436680_amd64",
            "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:af8e0eec77f039c81d68853d126042cf1d0d61db762f019ccc8a8f3145282435_s390x",
            "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:1e572fe0d7b1aa06b315ce506b7342429fa13c3b76676fd77246ff153e3edd7a_arm64",
            "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:395cdb02c412081da754cb3a54756da746e90296536caa8e9e560d2c461cd047_ppc64le",
            "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:d5ac2b9aed11bfa60b02deb83f83f28702a9c5b8081003f05dbe47619e037a44_s390x",
            "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:eae7d1853ab166c25f0af60543de5ad5c9a7b4ac48dba6b672a24451eeb1ac6f_amd64",
            "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:462297cea11fb99476264faa8fef27b8f75045961080159550d5c88c5d1af7a4_arm64",
            "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:6fff57b8fc3b932576742da3647c204b0b850f369ac38dc49c6b4785536d90dc_amd64",
            "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:90def498de78fc8c8904ec48530389628c20f51a51fb62a8652dd2c2721de3e4_ppc64le",
            "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:c43dd964a36d9b7c75aaf28cc19fdea81b0e85a802538d1fc146b29f23dd4240_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2024:2648"
        },
        {
          "category": "workaround",
          "details": "In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk.",
          "product_ids": [
            "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:49925f850770c4ccba59dbceb9ffe0d7c59e5acf7d0b54baf7b2dc7f1e9494de_ppc64le",
            "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:878e2f7b4af26196d30faf110a667238addb4c67d039ccaa9196a45e45af127a_amd64",
            "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:ad023433c7b4ce0ecd159db915236de9a3273b0bc24edfb31dbbafd8b9706bb1_s390x",
            "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:ef2c80336249bf864d4ccab747f7097766f368a575e2e45645fa92bd19acfd60_arm64",
            "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:2ce17ffcaa145ab476d367862c017a55e9cd4898c3f389906e6705ef992c1e1f_arm64",
            "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:6698ed0920b36f2581438ab6000db8118c7be63407d644f64c644549f8ef019d_ppc64le",
            "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:75039a8f5bd901b241105bd167f5bfcda4bf93046d44d407a0c4e0c3bc436680_amd64",
            "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:af8e0eec77f039c81d68853d126042cf1d0d61db762f019ccc8a8f3145282435_s390x",
            "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:1e572fe0d7b1aa06b315ce506b7342429fa13c3b76676fd77246ff153e3edd7a_arm64",
            "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:395cdb02c412081da754cb3a54756da746e90296536caa8e9e560d2c461cd047_ppc64le",
            "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:d5ac2b9aed11bfa60b02deb83f83f28702a9c5b8081003f05dbe47619e037a44_s390x",
            "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:eae7d1853ab166c25f0af60543de5ad5c9a7b4ac48dba6b672a24451eeb1ac6f_amd64",
            "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:462297cea11fb99476264faa8fef27b8f75045961080159550d5c88c5d1af7a4_arm64",
            "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:6fff57b8fc3b932576742da3647c204b0b850f369ac38dc49c6b4785536d90dc_amd64",
            "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:90def498de78fc8c8904ec48530389628c20f51a51fb62a8652dd2c2721de3e4_ppc64le",
            "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:c43dd964a36d9b7c75aaf28cc19fdea81b0e85a802538d1fc146b29f23dd4240_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:49925f850770c4ccba59dbceb9ffe0d7c59e5acf7d0b54baf7b2dc7f1e9494de_ppc64le",
            "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:878e2f7b4af26196d30faf110a667238addb4c67d039ccaa9196a45e45af127a_amd64",
            "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:ad023433c7b4ce0ecd159db915236de9a3273b0bc24edfb31dbbafd8b9706bb1_s390x",
            "8Base-LVMS-4.13:lvms4/lvms-must-gather-rhel8@sha256:ef2c80336249bf864d4ccab747f7097766f368a575e2e45645fa92bd19acfd60_arm64",
            "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:2ce17ffcaa145ab476d367862c017a55e9cd4898c3f389906e6705ef992c1e1f_arm64",
            "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:6698ed0920b36f2581438ab6000db8118c7be63407d644f64c644549f8ef019d_ppc64le",
            "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:75039a8f5bd901b241105bd167f5bfcda4bf93046d44d407a0c4e0c3bc436680_amd64",
            "8Base-LVMS-4.13:lvms4/lvms-operator-bundle@sha256:af8e0eec77f039c81d68853d126042cf1d0d61db762f019ccc8a8f3145282435_s390x",
            "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:1e572fe0d7b1aa06b315ce506b7342429fa13c3b76676fd77246ff153e3edd7a_arm64",
            "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:395cdb02c412081da754cb3a54756da746e90296536caa8e9e560d2c461cd047_ppc64le",
            "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:d5ac2b9aed11bfa60b02deb83f83f28702a9c5b8081003f05dbe47619e037a44_s390x",
            "8Base-LVMS-4.13:lvms4/lvms-rhel8-operator@sha256:eae7d1853ab166c25f0af60543de5ad5c9a7b4ac48dba6b672a24451eeb1ac6f_amd64",
            "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:462297cea11fb99476264faa8fef27b8f75045961080159550d5c88c5d1af7a4_arm64",
            "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:6fff57b8fc3b932576742da3647c204b0b850f369ac38dc49c6b4785536d90dc_amd64",
            "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:90def498de78fc8c8904ec48530389628c20f51a51fb62a8652dd2c2721de3e4_ppc64le",
            "8Base-LVMS-4.13:lvms4/topolvm-rhel8@sha256:c43dd964a36d9b7c75aaf28cc19fdea81b0e85a802538d1fc146b29f23dd4240_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS"
    }
  ]
}

CVE-2023-45288 (GCVE-0-2023-45288)

Vulnerability from cvelistv5 – Published: 2024-04-04 20:37 – Updated: 2025-11-04 18:17

Title

HTTP/2 CONTINUATION flood in net/http

Summary

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-05 17:08 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

References

9 references

URL	Tags
https://go.dev/issue/65051
https://go.dev/cl/576155
https://groups.google.com/g/golang-announce/c/YgW…
https://pkg.go.dev/vuln/GO-2024-2687
https://security.netapp.com/advisory/ntap-2024041…
https://lists.fedoraproject.org/archives/list/pac…
http://www.openwall.com/lists/oss-security/2024/04/05/4
http://www.openwall.com/lists/oss-security/2024/0…
https://www.kb.cert.org/vuls/id/421644

Impacted products

4 products

Vendor	Product	Version
Go standard library	net/http	Affected: 0 , < 1.21.9 (semver) Affected: 1.22.0-0 , < 1.22.2 (semver)
golang.org/x/net	golang.org/x/net/http2	Affected: 0 , < 0.23.0 (semver)
go_standard_library	net\/http	Affected: 0 , < 1.21.9 (custom) Affected: 1.22.0-0 , < 1.22.2 (custom) cpe:2.3:a:go_standard_library:net\/http::::::::
golang	http2	Affected: 0 , < 0.23.0 (custom) cpe:2.3:a:golang:http2::::::::

Credits

Bartek Nowotarski (https://nowotarski.info/)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:17:43.583Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/65051"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/576155"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2024-2687"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240419-0009/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/04/05/4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/04/03/16"
          },
          {
            "url": "https://www.kb.cert.org/vuls/id/421644"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:go_standard_library:net\\/http:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "net\\/http",
            "vendor": "go_standard_library",
            "versions": [
              {
                "lessThan": "1.21.9",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "1.22.2",
                "status": "affected",
                "version": "1.22.0-0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:golang:http2:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "http2",
            "vendor": "golang",
            "versions": [
              {
                "lessThan": "0.23.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-45288",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-05T17:08:42.212936Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-26T20:40:01.996Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "http2Framer.readMetaFrame"
            },
            {
              "name": "CanonicalHeaderKey"
            },
            {
              "name": "Client.CloseIdleConnections"
            },
            {
              "name": "Client.Do"
            },
            {
              "name": "Client.Get"
            },
            {
              "name": "Client.Head"
            },
            {
              "name": "Client.Post"
            },
            {
              "name": "Client.PostForm"
            },
            {
              "name": "Cookie.String"
            },
            {
              "name": "Cookie.Valid"
            },
            {
              "name": "Dir.Open"
            },
            {
              "name": "Error"
            },
            {
              "name": "Get"
            },
            {
              "name": "HandlerFunc.ServeHTTP"
            },
            {
              "name": "Head"
            },
            {
              "name": "Header.Add"
            },
            {
              "name": "Header.Del"
            },
            {
              "name": "Header.Get"
            },
            {
              "name": "Header.Set"
            },
            {
              "name": "Header.Values"
            },
            {
              "name": "Header.Write"
            },
            {
              "name": "Header.WriteSubset"
            },
            {
              "name": "ListenAndServe"
            },
            {
              "name": "ListenAndServeTLS"
            },
            {
              "name": "NewRequest"
            },
            {
              "name": "NewRequestWithContext"
            },
            {
              "name": "NotFound"
            },
            {
              "name": "ParseTime"
            },
            {
              "name": "Post"
            },
            {
              "name": "PostForm"
            },
            {
              "name": "ProxyFromEnvironment"
            },
            {
              "name": "ReadRequest"
            },
            {
              "name": "ReadResponse"
            },
            {
              "name": "Redirect"
            },
            {
              "name": "Request.AddCookie"
            },
            {
              "name": "Request.BasicAuth"
            },
            {
              "name": "Request.FormFile"
            },
            {
              "name": "Request.FormValue"
            },
            {
              "name": "Request.MultipartReader"
            },
            {
              "name": "Request.ParseForm"
            },
            {
              "name": "Request.ParseMultipartForm"
            },
            {
              "name": "Request.PostFormValue"
            },
            {
              "name": "Request.Referer"
            },
            {
              "name": "Request.SetBasicAuth"
            },
            {
              "name": "Request.UserAgent"
            },
            {
              "name": "Request.Write"
            },
            {
              "name": "Request.WriteProxy"
            },
            {
              "name": "Response.Cookies"
            },
            {
              "name": "Response.Location"
            },
            {
              "name": "Response.Write"
            },
            {
              "name": "ResponseController.EnableFullDuplex"
            },
            {
              "name": "ResponseController.Flush"
            },
            {
              "name": "ResponseController.Hijack"
            },
            {
              "name": "ResponseController.SetReadDeadline"
            },
            {
              "name": "ResponseController.SetWriteDeadline"
            },
            {
              "name": "Serve"
            },
            {
              "name": "ServeContent"
            },
            {
              "name": "ServeFile"
            },
            {
              "name": "ServeMux.ServeHTTP"
            },
            {
              "name": "ServeTLS"
            },
            {
              "name": "Server.Close"
            },
            {
              "name": "Server.ListenAndServe"
            },
            {
              "name": "Server.ListenAndServeTLS"
            },
            {
              "name": "Server.Serve"
            },
            {
              "name": "Server.ServeTLS"
            },
            {
              "name": "Server.SetKeepAlivesEnabled"
            },
            {
              "name": "Server.Shutdown"
            },
            {
              "name": "SetCookie"
            },
            {
              "name": "Transport.CancelRequest"
            },
            {
              "name": "Transport.Clone"
            },
            {
              "name": "Transport.CloseIdleConnections"
            },
            {
              "name": "Transport.RoundTrip"
            },
            {
              "name": "body.Close"
            },
            {
              "name": "body.Read"
            },
            {
              "name": "bodyEOFSignal.Close"
            },
            {
              "name": "bodyEOFSignal.Read"
            },
            {
              "name": "bodyLocked.Read"
            },
            {
              "name": "bufioFlushWriter.Write"
            },
            {
              "name": "cancelTimerBody.Close"
            },
            {
              "name": "cancelTimerBody.Read"
            },
            {
              "name": "checkConnErrorWriter.Write"
            },
            {
              "name": "chunkWriter.Write"
            },
            {
              "name": "connReader.Read"
            },
            {
              "name": "connectMethodKey.String"
            },
            {
              "name": "expectContinueReader.Close"
            },
            {
              "name": "expectContinueReader.Read"
            },
            {
              "name": "extraHeader.Write"
            },
            {
              "name": "fileHandler.ServeHTTP"
            },
            {
              "name": "fileTransport.RoundTrip"
            },
            {
              "name": "globalOptionsHandler.ServeHTTP"
            },
            {
              "name": "gzipReader.Close"
            },
            {
              "name": "gzipReader.Read"
            },
            {
              "name": "http2ClientConn.Close"
            },
            {
              "name": "http2ClientConn.Ping"
            },
            {
              "name": "http2ClientConn.RoundTrip"
            },
            {
              "name": "http2ClientConn.Shutdown"
            },
            {
              "name": "http2ConnectionError.Error"
            },
            {
              "name": "http2ErrCode.String"
            },
            {
              "name": "http2FrameHeader.String"
            },
            {
              "name": "http2FrameType.String"
            },
            {
              "name": "http2FrameWriteRequest.String"
            },
            {
              "name": "http2Framer.ReadFrame"
            },
            {
              "name": "http2Framer.WriteContinuation"
            },
            {
              "name": "http2Framer.WriteData"
            },
            {
              "name": "http2Framer.WriteDataPadded"
            },
            {
              "name": "http2Framer.WriteGoAway"
            },
            {
              "name": "http2Framer.WriteHeaders"
            },
            {
              "name": "http2Framer.WritePing"
            },
            {
              "name": "http2Framer.WritePriority"
            },
            {
              "name": "http2Framer.WritePushPromise"
            },
            {
              "name": "http2Framer.WriteRSTStream"
            },
            {
              "name": "http2Framer.WriteRawFrame"
            },
            {
              "name": "http2Framer.WriteSettings"
            },
            {
              "name": "http2Framer.WriteSettingsAck"
            },
            {
              "name": "http2Framer.WriteWindowUpdate"
            },
            {
              "name": "http2GoAwayError.Error"
            },
            {
              "name": "http2Server.ServeConn"
            },
            {
              "name": "http2Setting.String"
            },
            {
              "name": "http2SettingID.String"
            },
            {
              "name": "http2SettingsFrame.ForeachSetting"
            },
            {
              "name": "http2StreamError.Error"
            },
            {
              "name": "http2Transport.CloseIdleConnections"
            },
            {
              "name": "http2Transport.NewClientConn"
            },
            {
              "name": "http2Transport.RoundTrip"
            },
            {
              "name": "http2Transport.RoundTripOpt"
            },
            {
              "name": "http2bufferedWriter.Flush"
            },
            {
              "name": "http2bufferedWriter.Write"
            },
            {
              "name": "http2chunkWriter.Write"
            },
            {
              "name": "http2clientConnPool.GetClientConn"
            },
            {
              "name": "http2connError.Error"
            },
            {
              "name": "http2dataBuffer.Read"
            },
            {
              "name": "http2duplicatePseudoHeaderError.Error"
            },
            {
              "name": "http2gzipReader.Close"
            },
            {
              "name": "http2gzipReader.Read"
            },
            {
              "name": "http2headerFieldNameError.Error"
            },
            {
              "name": "http2headerFieldValueError.Error"
            },
            {
              "name": "http2noDialClientConnPool.GetClientConn"
            },
            {
              "name": "http2noDialH2RoundTripper.RoundTrip"
            },
            {
              "name": "http2pipe.Read"
            },
            {
              "name": "http2priorityWriteScheduler.CloseStream"
            },
            {
              "name": "http2priorityWriteScheduler.OpenStream"
            },
            {
              "name": "http2pseudoHeaderError.Error"
            },
            {
              "name": "http2requestBody.Close"
            },
            {
              "name": "http2requestBody.Read"
            },
            {
              "name": "http2responseWriter.Flush"
            },
            {
              "name": "http2responseWriter.FlushError"
            },
            {
              "name": "http2responseWriter.Push"
            },
            {
              "name": "http2responseWriter.SetReadDeadline"
            },
            {
              "name": "http2responseWriter.SetWriteDeadline"
            },
            {
              "name": "http2responseWriter.Write"
            },
            {
              "name": "http2responseWriter.WriteHeader"
            },
            {
              "name": "http2responseWriter.WriteString"
            },
            {
              "name": "http2roundRobinWriteScheduler.OpenStream"
            },
            {
              "name": "http2serverConn.CloseConn"
            },
            {
              "name": "http2serverConn.Flush"
            },
            {
              "name": "http2stickyErrWriter.Write"
            },
            {
              "name": "http2transportResponseBody.Close"
            },
            {
              "name": "http2transportResponseBody.Read"
            },
            {
              "name": "http2writeData.String"
            },
            {
              "name": "initALPNRequest.ServeHTTP"
            },
            {
              "name": "loggingConn.Close"
            },
            {
              "name": "loggingConn.Read"
            },
            {
              "name": "loggingConn.Write"
            },
            {
              "name": "maxBytesReader.Close"
            },
            {
              "name": "maxBytesReader.Read"
            },
            {
              "name": "onceCloseListener.Close"
            },
            {
              "name": "persistConn.Read"
            },
            {
              "name": "persistConnWriter.ReadFrom"
            },
            {
              "name": "persistConnWriter.Write"
            },
            {
              "name": "populateResponse.Write"
            },
            {
              "name": "populateResponse.WriteHeader"
            },
            {
              "name": "readTrackingBody.Close"
            },
            {
              "name": "readTrackingBody.Read"
            },
            {
              "name": "readWriteCloserBody.Read"
            },
            {
              "name": "redirectHandler.ServeHTTP"
            },
            {
              "name": "response.Flush"
            },
            {
              "name": "response.FlushError"
            },
            {
              "name": "response.Hijack"
            },
            {
              "name": "response.ReadFrom"
            },
            {
              "name": "response.Write"
            },
            {
              "name": "response.WriteHeader"
            },
            {
              "name": "response.WriteString"
            },
            {
              "name": "serverHandler.ServeHTTP"
            },
            {
              "name": "socksDialer.DialWithConn"
            },
            {
              "name": "socksUsernamePassword.Authenticate"
            },
            {
              "name": "stringWriter.WriteString"
            },
            {
              "name": "timeoutHandler.ServeHTTP"
            },
            {
              "name": "timeoutWriter.Write"
            },
            {
              "name": "timeoutWriter.WriteHeader"
            },
            {
              "name": "transportReadFromServerError.Error"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.21.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.22.2",
              "status": "affected",
              "version": "1.22.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/net/http2",
          "product": "golang.org/x/net/http2",
          "programRoutines": [
            {
              "name": "Framer.readMetaFrame"
            },
            {
              "name": "ClientConn.Close"
            },
            {
              "name": "ClientConn.Ping"
            },
            {
              "name": "ClientConn.RoundTrip"
            },
            {
              "name": "ClientConn.Shutdown"
            },
            {
              "name": "ConfigureServer"
            },
            {
              "name": "ConfigureTransport"
            },
            {
              "name": "ConfigureTransports"
            },
            {
              "name": "ConnectionError.Error"
            },
            {
              "name": "ErrCode.String"
            },
            {
              "name": "FrameHeader.String"
            },
            {
              "name": "FrameType.String"
            },
            {
              "name": "FrameWriteRequest.String"
            },
            {
              "name": "Framer.ReadFrame"
            },
            {
              "name": "Framer.WriteContinuation"
            },
            {
              "name": "Framer.WriteData"
            },
            {
              "name": "Framer.WriteDataPadded"
            },
            {
              "name": "Framer.WriteGoAway"
            },
            {
              "name": "Framer.WriteHeaders"
            },
            {
              "name": "Framer.WritePing"
            },
            {
              "name": "Framer.WritePriority"
            },
            {
              "name": "Framer.WritePushPromise"
            },
            {
              "name": "Framer.WriteRSTStream"
            },
            {
              "name": "Framer.WriteRawFrame"
            },
            {
              "name": "Framer.WriteSettings"
            },
            {
              "name": "Framer.WriteSettingsAck"
            },
            {
              "name": "Framer.WriteWindowUpdate"
            },
            {
              "name": "GoAwayError.Error"
            },
            {
              "name": "ReadFrameHeader"
            },
            {
              "name": "Server.ServeConn"
            },
            {
              "name": "Setting.String"
            },
            {
              "name": "SettingID.String"
            },
            {
              "name": "SettingsFrame.ForeachSetting"
            },
            {
              "name": "StreamError.Error"
            },
            {
              "name": "Transport.CloseIdleConnections"
            },
            {
              "name": "Transport.NewClientConn"
            },
            {
              "name": "Transport.RoundTrip"
            },
            {
              "name": "Transport.RoundTripOpt"
            },
            {
              "name": "bufferedWriter.Flush"
            },
            {
              "name": "bufferedWriter.Write"
            },
            {
              "name": "chunkWriter.Write"
            },
            {
              "name": "clientConnPool.GetClientConn"
            },
            {
              "name": "connError.Error"
            },
            {
              "name": "dataBuffer.Read"
            },
            {
              "name": "duplicatePseudoHeaderError.Error"
            },
            {
              "name": "gzipReader.Close"
            },
            {
              "name": "gzipReader.Read"
            },
            {
              "name": "headerFieldNameError.Error"
            },
            {
              "name": "headerFieldValueError.Error"
            },
            {
              "name": "noDialClientConnPool.GetClientConn"
            },
            {
              "name": "noDialH2RoundTripper.RoundTrip"
            },
            {
              "name": "pipe.Read"
            },
            {
              "name": "priorityWriteScheduler.CloseStream"
            },
            {
              "name": "priorityWriteScheduler.OpenStream"
            },
            {
              "name": "pseudoHeaderError.Error"
            },
            {
              "name": "requestBody.Close"
            },
            {
              "name": "requestBody.Read"
            },
            {
              "name": "responseWriter.Flush"
            },
            {
              "name": "responseWriter.FlushError"
            },
            {
              "name": "responseWriter.Push"
            },
            {
              "name": "responseWriter.SetReadDeadline"
            },
            {
              "name": "responseWriter.SetWriteDeadline"
            },
            {
              "name": "responseWriter.Write"
            },
            {
              "name": "responseWriter.WriteHeader"
            },
            {
              "name": "responseWriter.WriteString"
            },
            {
              "name": "roundRobinWriteScheduler.OpenStream"
            },
            {
              "name": "serverConn.CloseConn"
            },
            {
              "name": "serverConn.Flush"
            },
            {
              "name": "stickyErrWriter.Write"
            },
            {
              "name": "transportResponseBody.Close"
            },
            {
              "name": "transportResponseBody.Read"
            },
            {
              "name": "writeData.String"
            }
          ],
          "vendor": "golang.org/x/net",
          "versions": [
            {
              "lessThan": "0.23.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Bartek Nowotarski (https://nowotarski.info/)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request\u0027s headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-01T17:10:07.754Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/65051"
        },
        {
          "url": "https://go.dev/cl/576155"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2687"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240419-0009/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/04/05/4"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/04/03/16"
        }
      ],
      "title": "HTTP/2 CONTINUATION flood in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2023-45288",
    "datePublished": "2024-04-04T20:37:30.714Z",
    "dateReserved": "2023-10-06T17:06:26.221Z",
    "dateUpdated": "2025-11-04T18:17:43.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHBA-2024:2648

CVE-2023-45288 (GCVE-0-2023-45288)

Tags

Sightings

Nomenclature