PT-2024-2623 · Tempesta · Tempesta

Krizhanovsky · Published 2024-04-03 · Updated 2024-10-30 · CVE-2024-2758

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tempesta (affected versions not specified)

Description The issue is related to a firewall vulnerability in the implementation of the HTTP/2 protocol, specifically concerning the handling of CONTINUATION frames. This can lead to an uncontrolled consumption of resources due to incorrect detection of the end of a header. An attacker could exploit this to cause a denial of service. The rate limits in Tempesta FW are not enabled by default and may be set either too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2024-02690

CVE-2024-2758

GHSA-3XWJ-5CH3-Q9P4

Affected Products

Tempesta

References · 9

• https://bdu.fstec.ru/vul/2024-02690 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2758 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2758 · Security Note
• https://github.com/tempesta-tech/tempesta/security/advisories/GHSA-3xwj-5ch3-q9p4 · Note
• https://t.me/echeloneyes/2638 · Telegram Post
• https://kb.cert.org/vuls/id/421644 · Note
• https://t.me/cvenotify/75719 · Telegram Post
• https://t.me/cvenotify/75656 · Telegram Post
• http://openwall.com/lists/oss-security/2024/04/03/16 · Note