CVE-2023-45802

CVE Details

Release Date:

2023-10-19

Description

When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that.\nThis was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During \normal\ HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out.\nUsers are recommended to upgrade to version 2.4.58, which fixes the issue.

See more information about CVE-2023-45802 from MITRE CVE dictionary and NIST NVD

CVSS v3.0 metrics

NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.

Base Score:	7.5	Base Metrics:	AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Access Vector:	Network	Attack Complexity:	Low
Privileges Required:	None	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	None	Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (httpd)	ELSA-2024-3121	2024-05-24
Oracle Linux version 8 (mod_http2)	ELSA-2024-3121	2024-05-24
Oracle Linux version 8 (mod_md)	ELSA-2024-3121	2024-05-24
Oracle Linux version 9 (mod_http2)	ELSA-2024-2368	2024-05-02

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team