PT-2023-33006 · Unknown+1 · Go Http/2 Protocol Stack+1

Published 2023-10-17 · Updated 2023-10-17

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Envoy and Go HTTP/2 protocol stack (affected versions not specified)

Description The issue concerns a vulnerability to the "Rapid Reset" class of exploits. This can be triggered by sending a sequence of HEADERS frames optionally followed by RST STREAM frames, particularly when receiving untrusted HTTP/2 traffic through the builtin gateway.

Recommendations Disable HTTP/2 on the gateway listener with a MeshProxyPatch or ProxyTemplate as a temporary workaround. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-9WMC-RG4H-28WV

Affected Products

Envoy

Go Http/2 Protocol Stack

References · 12

• https://osv.dev/vulnerability/GHSA-9wmc-rg4h-28wv · Vendor Advisory
• https://github.com/golang/go/issues/63417 · Note
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76 · Note
• https://github.com/kumahq/kuma · Note
• https://github.com/kumahq/kuma/pull/8034 · Note
• https://github.com/kumahq/kuma/pull/8023 · Note
• https://github.com/kumahq/kuma/pull/8001 · Note
• https://github.com/kumahq/kuma/security/advisories/GHSA-9wmc-rg4h-28wv · Note
• https://envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge · Note
• https://github.com/advisories/GHSA-qppj-fm5r-hxr3 · Note
• https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack · Note
• https://nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/?sf269548684=1 · Note