github.com/kumahq/kuma affected by CVE-2023-44487
Package
Affected versions
>= 2.4.0, < 2.4.3
>= 2.3.0, < 2.3.3
>= 2.2.0, < 2.2.4
>= 2.1.0, < 2.1.8
< 2.0.8
Patched versions
2.4.3
2.3.3
2.2.4
2.1.8
2.0.8
Description
Published to the GitHub Advisory Database
Oct 17, 2023
Reviewed
Oct 17, 2023
Last updated
Oct 19, 2023
Impact
Envoy and Go HTTP/2 protocol stack is vulnerable to the "Rapid Reset" class of exploits, which send a sequence of HEADERS frames optionally followed by RST_STREAM frames.
This can be exercised if you use the builtin gateway and receive untrusted http2 traffic.
Patches
kumahq/kuma#8023
kumahq/kuma#8001
kumahq/kuma#8034
Workarounds
Disable http2 on the gateway listener with a MeshProxyPatch or ProxyTemplate.
References
GHSA-qppj-fm5r-hxr3
golang/go#63417
GHSA-jhv4-f7mr-xx76
https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/?sf269548684=1
https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge
References