CVE-2023-43622

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-43622
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-43622.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-43622
Aliases
Related
Published
2023-10-23T07:15:11Z
Modified
2024-09-11T05:01:59.534530Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.

Users are recommended to upgrade to version 2.4.58, which fixes the issue.

References

Affected packages

Alpine:v3.15 / apache2

Package

Name
apache2
Purl
pkg:apk/alpine/apache2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.58-r0

Affected versions

2.*

2.2.16-r0
2.2.16-r1
2.2.16-r2
2.2.16-r3
2.2.17-r0
2.2.17-r1
2.2.17-r2
2.2.17-r3
2.2.17-r4
2.2.17-r5
2.2.20-r0
2.2.21-r0
2.2.21-r1
2.2.21-r2
2.2.21-r3
2.2.22-r0
2.2.22-r1
2.4.3-r0
2.4.3-r1
2.4.3-r2
2.4.4-r0
2.4.4-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.7-r0
2.4.9-r0
2.4.9-r1
2.4.10-r0
2.4.12-r0
2.4.12-r1
2.4.12-r2
2.4.12-r3
2.4.12-r4
2.4.16-r0
2.4.17-r0
2.4.17-r1
2.4.17-r2
2.4.17-r3
2.4.17-r4
2.4.17-r5
2.4.17-r6
2.4.17-r7
2.4.18-r0
2.4.18-r1
2.4.18-r2
2.4.20-r0
2.4.20-r1
2.4.20-r2
2.4.23-r0
2.4.23-r1
2.4.23-r2
2.4.23-r3
2.4.23-r4
2.4.23-r5
2.4.23-r6
2.4.23-r7
2.4.23-r8
2.4.23-r9
2.4.23-r10
2.4.25-r0
2.4.25-r1
2.4.26-r0
2.4.27-r0
2.4.27-r1
2.4.27-r2
2.4.28-r0
2.4.29-r0
2.4.29-r1
2.4.33-r0
2.4.33-r1
2.4.34-r0
2.4.35-r0
2.4.37-r0
2.4.37-r1
2.4.38-r0
2.4.38-r1
2.4.38-r2
2.4.39-r0
2.4.41-r0
2.4.43-r0
2.4.46-r0
2.4.46-r1
2.4.46-r2
2.4.46-r3
2.4.48-r0
2.4.48-r1
2.4.48-r2
2.4.49-r1
2.4.50-r0
2.4.51-r0
2.4.51-r1
2.4.52-r0
2.4.53-r0
2.4.54-r0
2.4.55-r0
2.4.56-r0

Alpine:v3.16 / apache2

Package

Name
apache2
Purl
pkg:apk/alpine/apache2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.58-r0

Affected versions

2.*

2.2.16-r0
2.2.16-r1
2.2.16-r2
2.2.16-r3
2.2.17-r0
2.2.17-r1
2.2.17-r2
2.2.17-r3
2.2.17-r4
2.2.17-r5
2.2.20-r0
2.2.21-r0
2.2.21-r1
2.2.21-r2
2.2.21-r3
2.2.22-r0
2.2.22-r1
2.4.3-r0
2.4.3-r1
2.4.3-r2
2.4.4-r0
2.4.4-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.7-r0
2.4.9-r0
2.4.9-r1
2.4.10-r0
2.4.12-r0
2.4.12-r1
2.4.12-r2
2.4.12-r3
2.4.12-r4
2.4.16-r0
2.4.17-r0
2.4.17-r1
2.4.17-r2
2.4.17-r3
2.4.17-r4
2.4.17-r5
2.4.17-r6
2.4.17-r7
2.4.18-r0
2.4.18-r1
2.4.18-r2
2.4.20-r0
2.4.20-r1
2.4.20-r2
2.4.23-r0
2.4.23-r1
2.4.23-r2
2.4.23-r3
2.4.23-r4
2.4.23-r5
2.4.23-r6
2.4.23-r7
2.4.23-r8
2.4.23-r9
2.4.23-r10
2.4.25-r0
2.4.25-r1
2.4.26-r0
2.4.27-r0
2.4.27-r1
2.4.27-r2
2.4.28-r0
2.4.29-r0
2.4.29-r1
2.4.33-r0
2.4.33-r1
2.4.34-r0
2.4.35-r0
2.4.37-r0
2.4.37-r1
2.4.38-r0
2.4.38-r1
2.4.38-r2
2.4.39-r0
2.4.41-r0
2.4.43-r0
2.4.46-r0
2.4.46-r1
2.4.46-r2
2.4.46-r3
2.4.48-r0
2.4.48-r1
2.4.48-r2
2.4.49-r1
2.4.50-r0
2.4.51-r0
2.4.51-r1
2.4.52-r0
2.4.53-r0
2.4.54-r0
2.4.55-r0
2.4.56-r0

Alpine:v3.17 / apache2

Package

Name
apache2
Purl
pkg:apk/alpine/apache2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.58-r0

Affected versions

2.*

2.2.16-r0
2.2.16-r1
2.2.16-r2
2.2.16-r3
2.2.17-r0
2.2.17-r1
2.2.17-r2
2.2.17-r3
2.2.17-r4
2.2.17-r5
2.2.20-r0
2.2.21-r0
2.2.21-r1
2.2.21-r2
2.2.21-r3
2.2.22-r0
2.2.22-r1
2.4.3-r0
2.4.3-r1
2.4.3-r2
2.4.4-r0
2.4.4-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.7-r0
2.4.9-r0
2.4.9-r1
2.4.10-r0
2.4.12-r0
2.4.12-r1
2.4.12-r2
2.4.12-r3
2.4.12-r4
2.4.16-r0
2.4.17-r0
2.4.17-r1
2.4.17-r2
2.4.17-r3
2.4.17-r4
2.4.17-r5
2.4.17-r6
2.4.17-r7
2.4.18-r0
2.4.18-r1
2.4.18-r2
2.4.20-r0
2.4.20-r1
2.4.20-r2
2.4.23-r0
2.4.23-r1
2.4.23-r2
2.4.23-r3
2.4.23-r4
2.4.23-r5
2.4.23-r6
2.4.23-r7
2.4.23-r8
2.4.23-r9
2.4.23-r10
2.4.25-r0
2.4.25-r1
2.4.26-r0
2.4.27-r0
2.4.27-r1
2.4.27-r2
2.4.28-r0
2.4.29-r0
2.4.29-r1
2.4.33-r0
2.4.33-r1
2.4.34-r0
2.4.35-r0
2.4.37-r0
2.4.37-r1
2.4.38-r0
2.4.38-r1
2.4.38-r2
2.4.39-r0
2.4.41-r0
2.4.43-r0
2.4.46-r0
2.4.46-r1
2.4.46-r2
2.4.46-r3
2.4.48-r0
2.4.48-r1
2.4.48-r2
2.4.49-r1
2.4.50-r0
2.4.51-r0
2.4.51-r1
2.4.52-r0
2.4.53-r0
2.4.54-r0
2.4.54-r1
2.4.55-r0
2.4.56-r0
2.4.57-r0

Alpine:v3.18 / apache2

Package

Name
apache2
Purl
pkg:apk/alpine/apache2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.58-r0

Affected versions

2.*

2.2.16-r0
2.2.16-r1
2.2.16-r2
2.2.16-r3
2.2.17-r0
2.2.17-r1
2.2.17-r2
2.2.17-r3
2.2.17-r4
2.2.17-r5
2.2.20-r0
2.2.21-r0
2.2.21-r1
2.2.21-r2
2.2.21-r3
2.2.22-r0
2.2.22-r1
2.4.3-r0
2.4.3-r1
2.4.3-r2
2.4.4-r0
2.4.4-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.7-r0
2.4.9-r0
2.4.9-r1
2.4.10-r0
2.4.12-r0
2.4.12-r1
2.4.12-r2
2.4.12-r3
2.4.12-r4
2.4.16-r0
2.4.17-r0
2.4.17-r1
2.4.17-r2
2.4.17-r3
2.4.17-r4
2.4.17-r5
2.4.17-r6
2.4.17-r7
2.4.18-r0
2.4.18-r1
2.4.18-r2
2.4.20-r0
2.4.20-r1
2.4.20-r2
2.4.23-r0
2.4.23-r1
2.4.23-r2
2.4.23-r3
2.4.23-r4
2.4.23-r5
2.4.23-r6
2.4.23-r7
2.4.23-r8
2.4.23-r9
2.4.23-r10
2.4.25-r0
2.4.25-r1
2.4.26-r0
2.4.27-r0
2.4.27-r1
2.4.27-r2
2.4.28-r0
2.4.29-r0
2.4.29-r1
2.4.33-r0
2.4.33-r1
2.4.34-r0
2.4.35-r0
2.4.37-r0
2.4.37-r1
2.4.38-r0
2.4.38-r1
2.4.38-r2
2.4.39-r0
2.4.41-r0
2.4.43-r0
2.4.46-r0
2.4.46-r1
2.4.46-r2
2.4.46-r3
2.4.48-r0
2.4.48-r1
2.4.48-r2
2.4.49-r1
2.4.50-r0
2.4.51-r0
2.4.51-r1
2.4.52-r0
2.4.53-r0
2.4.54-r0
2.4.54-r1
2.4.54-r2
2.4.55-r0
2.4.56-r0
2.4.57-r0
2.4.57-r1
2.4.57-r2
2.4.57-r3

Alpine:v3.19 / apache2

Package

Name
apache2
Purl
pkg:apk/alpine/apache2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.58-r0

Affected versions

2.*

2.2.16-r0
2.2.16-r1
2.2.16-r2
2.2.16-r3
2.2.17-r0
2.2.17-r1
2.2.17-r2
2.2.17-r3
2.2.17-r4
2.2.17-r5
2.2.20-r0
2.2.21-r0
2.2.21-r1
2.2.21-r2
2.2.21-r3
2.2.22-r0
2.2.22-r1
2.4.3-r0
2.4.3-r1
2.4.3-r2
2.4.4-r0
2.4.4-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.7-r0
2.4.9-r0
2.4.9-r1
2.4.10-r0
2.4.12-r0
2.4.12-r1
2.4.12-r2
2.4.12-r3
2.4.12-r4
2.4.16-r0
2.4.17-r0
2.4.17-r1
2.4.17-r2
2.4.17-r3
2.4.17-r4
2.4.17-r5
2.4.17-r6
2.4.17-r7
2.4.18-r0
2.4.18-r1
2.4.18-r2
2.4.20-r0
2.4.20-r1
2.4.20-r2
2.4.23-r0
2.4.23-r1
2.4.23-r2
2.4.23-r3
2.4.23-r4
2.4.23-r5
2.4.23-r6
2.4.23-r7
2.4.23-r8
2.4.23-r9
2.4.23-r10
2.4.25-r0
2.4.25-r1
2.4.26-r0
2.4.27-r0
2.4.27-r1
2.4.27-r2
2.4.28-r0
2.4.29-r0
2.4.29-r1
2.4.33-r0
2.4.33-r1
2.4.34-r0
2.4.35-r0
2.4.37-r0
2.4.37-r1
2.4.38-r0
2.4.38-r1
2.4.38-r2
2.4.39-r0
2.4.41-r0
2.4.43-r0
2.4.46-r0
2.4.46-r1
2.4.46-r2
2.4.46-r3
2.4.48-r0
2.4.48-r1
2.4.48-r2
2.4.49-r1
2.4.50-r0
2.4.51-r0
2.4.51-r1
2.4.52-r0
2.4.53-r0
2.4.54-r0
2.4.54-r1
2.4.54-r2
2.4.55-r0
2.4.56-r0
2.4.57-r0
2.4.57-r1
2.4.57-r2
2.4.57-r3

Alpine:v3.20 / apache2

Package

Name
apache2
Purl
pkg:apk/alpine/apache2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.58-r0

Affected versions

2.*

2.2.16-r0
2.2.16-r1
2.2.16-r2
2.2.16-r3
2.2.17-r0
2.2.17-r1
2.2.17-r2
2.2.17-r3
2.2.17-r4
2.2.17-r5
2.2.20-r0
2.2.21-r0
2.2.21-r1
2.2.21-r2
2.2.21-r3
2.2.22-r0
2.2.22-r1
2.4.3-r0
2.4.3-r1
2.4.3-r2
2.4.4-r0
2.4.4-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.7-r0
2.4.9-r0
2.4.9-r1
2.4.10-r0
2.4.12-r0
2.4.12-r1
2.4.12-r2
2.4.12-r3
2.4.12-r4
2.4.16-r0
2.4.17-r0
2.4.17-r1
2.4.17-r2
2.4.17-r3
2.4.17-r4
2.4.17-r5
2.4.17-r6
2.4.17-r7
2.4.18-r0
2.4.18-r1
2.4.18-r2
2.4.20-r0
2.4.20-r1
2.4.20-r2
2.4.23-r0
2.4.23-r1
2.4.23-r2
2.4.23-r3
2.4.23-r4
2.4.23-r5
2.4.23-r6
2.4.23-r7
2.4.23-r8
2.4.23-r9
2.4.23-r10
2.4.25-r0
2.4.25-r1
2.4.26-r0
2.4.27-r0
2.4.27-r1
2.4.27-r2
2.4.28-r0
2.4.29-r0
2.4.29-r1
2.4.33-r0
2.4.33-r1
2.4.34-r0
2.4.35-r0
2.4.37-r0
2.4.37-r1
2.4.38-r0
2.4.38-r1
2.4.38-r2
2.4.39-r0
2.4.41-r0
2.4.43-r0
2.4.46-r0
2.4.46-r1
2.4.46-r2
2.4.46-r3
2.4.48-r0
2.4.48-r1
2.4.48-r2
2.4.49-r1
2.4.50-r0
2.4.51-r0
2.4.51-r1
2.4.52-r0
2.4.53-r0
2.4.54-r0
2.4.54-r1
2.4.54-r2
2.4.55-r0
2.4.56-r0
2.4.57-r0
2.4.57-r1
2.4.57-r2
2.4.57-r3

Debian:11 / apache2

Package

Name
apache2
Purl
pkg:deb/debian/apache2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.59-1~deb11u1

Affected versions

2.*

2.4.48-3.1
2.4.48-3.1+deb11u1
2.4.48-4
2.4.49-1~bpo10+1
2.4.49-1~deb11u1
2.4.49-1~deb11u2
2.4.49-1~deb11u3
2.4.49-1
2.4.49-2
2.4.49-3
2.4.49-4
2.4.50-1~deb11u1
2.4.50-1
2.4.51-1~bpo10+1
2.4.51-1~bpo10+2
2.4.51-1~deb11u1
2.4.51-1
2.4.51-2
2.4.52-1~bpo10+1
2.4.52-1~deb11u1
2.4.52-1~deb11u2
2.4.52-1
2.4.52-2
2.4.52-3
2.4.53-1~deb11u1
2.4.53-1
2.4.53-2~bpo10+1
2.4.53-2
2.4.54-1~deb11u1
2.4.54-1
2.4.54-2
2.4.54-3
2.4.54-4
2.4.54-5
2.4.55-1
2.4.56-1~deb11u1
2.4.56-1~deb11u2
2.4.56-1
2.4.56-2
2.4.57-1
2.4.57-2
2.4.57-3
2.4.58-1
2.4.59-1~deb10u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / apache2

Package

Name
apache2
Purl
pkg:deb/debian/apache2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.59-1~deb12u1

Affected versions

2.*

2.4.57-2
2.4.57-3
2.4.58-1
2.4.59-1~deb10u1
2.4.59-1~deb11u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / apache2

Package

Name
apache2
Purl
pkg:deb/debian/apache2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.58-1

Affected versions

2.*

2.4.57-2
2.4.57-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/apache/httpd

Affected ranges

Type
GIT
Repo
https://github.com/apache/httpd
Events
Introduced
8201e867f1d4cdf61840625c6c4be901e3f1b6ba
Fixed
c3ad18b7ee32da93eabaae7b94541d3c32264340