Date: Fri, 13 Oct 2023 19:32:28 +0200 From: Steffen Nurpmeso <steffen@...oden.eu> To: oss-security@...ts.openwall.com Subject: Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations Jonathan Wright wrote in <CAKe4=-L2udnhRQ7EVOMihrExiYUVoor3E0+FbNxvZ8iB=pyQ1w@...l.gmail.com>: [i resort a bit] |On Tue, Oct 10, 2023 at 2:23 PM Moritz Muehlenhoff <jmm@...til.org> wrote: |> On Tue, Oct 10, 2023 at 11:40:06AM -0700, Alan Coopersmith wrote: |>> Information I've found so far on open source implementations (most via |> the |>> current listings in the CVE) include: |> |> Apache Trafficserver is also affected: |> https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q |OpenLitespeed is not impacted: |https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/ It did not really surprise me that Glenn Strauss, the wonderful developer of the lighttpd that i use for eight years, had to go like this (i hope he does not mind i quote #lighttpd here): ... 01:45 < gps> [..]No, I did not have prior knowledge. ... 02:20 < gps> Confirmed: while all web servers implementing HTTP/2 are exposed to the attack in CVE-2023-44487, the way each web server software processes HTTP/2 affects the size of the impact of the attack. With lighttpd, the impact is largely limited to the CPU usage parsing the HTTP/2 HEADERS frame, including HPACK decoding. ... 03:58 < gps> To be clear, the attack still causes lighttpd to use more resources, but the amplification of resource commitment is constrained in lighttpd due to the design choices made for lighttpd HTTP/2. --steffen | |Der Kragenbaer, The moon bear, |der holt sich munter he cheerfully and one by one |einen nach dem anderen runter wa.ks himself off |(By Robert Gernhardt)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.