CVE-2023-44487

Note

The nginx developers do not consider nginx to be affected by
this issue due to the default configuration restricting the
number of requests per connectiong (keepalive_requests). They
did provide a patch to harden nginx even further in environments
where the default are substantially modified.

haproxy was fixed in 2018 by the commit listed below

Debian's tomcat9 update caused a regression, investigate before
fixing tomcat packages.

Parameter	Value
Base score	7.5
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Security

CVE-2023-44487

Notes

Priority

Cvss 3 Severity Score

Status

Severity score breakdown

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Further reading

Package	Release	Status
haproxy Launchpad, Ubuntu, Debian	trusty	Ignored (end of standard support)
	xenial	Needs triage
	bionic	Needs triage
	focal	Not vulnerable (2.0.31-0ubuntu0.2)
	jammy	Not vulnerable (2.4.22-0ubuntu0.22.04.2)
	lunar	Not vulnerable (2.6.9-1ubuntu1.1)
	upstream	Needs triage
	mantic	Not vulnerable (2.6.15-1ubuntu2)
	Patches: upstream: http://git.haproxy.org/?p=haproxy.git;a=commit;h=f210191dc
nginx Launchpad, Ubuntu, Debian	bionic	Not vulnerable
	focal	Not vulnerable
	jammy	Not vulnerable
	mantic	Not vulnerable
	lunar	Not vulnerable
	trusty	Not vulnerable
	upstream	Not vulnerable
	xenial	Not vulnerable
	Patches: upstream: https://github.com/nginx/nginx/commit/6ceef192e7af1c507826ac38a2d43f08bf265fb9
tomcat10 Launchpad, Ubuntu, Debian	trusty	Ignored (end of standard support)
	xenial	Ignored (end of standard support)
	bionic	Ignored (end of standard support)
	focal	Does not exist
	jammy	Does not exist
	lunar	Needs triage
	upstream	Released (10.1.14)
	mantic	Needs triage
	Patches: upstream: https://github.com/apache/tomcat/commit/76bb4bfbfeae827dce896f650655bbf6e251ed49
tomcat9 Launchpad, Ubuntu, Debian	trusty	Ignored (end of standard support)
	xenial	Ignored (end of standard support)
	bionic	Needs triage
	focal	Needs triage
	jammy	Needs triage
	lunar	Needs triage
	upstream	Released (9.0.81)
	mantic	Needs triage
	Patches: upstream: https://github.com/apache/tomcat/commit/6d1a9fd6642387969e4410b9989c85856b74917a
trafficserver Launchpad, Ubuntu, Debian	trusty	Ignored (end of standard support)
	xenial	Needs triage
	bionic	Needs triage
	focal	Needs triage
	jammy	Needs triage
	lunar	Needs triage
	upstream	Needs triage
	mantic	Needs triage
	Patches: upstream: https://github.com/apache/trafficserver/commit/b28ad74f117307e8de206f1de70c3fa716f90682
h2o Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Needs triage
	focal	Needs triage
	jammy	Needs triage
	lunar	Needs triage
	upstream	Needs triage
	mantic	Needs triage
tomcat8 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Needs triage
	bionic	Needs triage
	focal	Does not exist
	jammy	Does not exist
	lunar	Does not exist
	upstream	Released (8.5.94)
	mantic	Does not exist
dotnet6 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Does not exist
	focal	Does not exist
	jammy	Released (6.0.123-0ubuntu1~22.04.1)
	lunar	Released (6.0.123-0ubuntu1~23.04.1)
	upstream	Released (6.0.23)
	mantic	Released (6.0.123-0ubuntu1)
dotnet7 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Does not exist
	focal	Does not exist
	jammy	Released (7.0.112-0ubuntu1~22.04.1)
	lunar	Released (7.0.112-0ubuntu1~23.04.1)
	upstream	Released (7.0.12)
	mantic	Released (7.0.112-0ubuntu1)
dotnet8 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	lunar	Does not exist
	upstream	Released (8.0.0-rc.2)
	mantic	Released (8.0.100-8.0.0~rc2-0ubuntu1)
nghttp2 Launchpad, Ubuntu, Debian	trusty	Ignored (end of standard support)
	xenial	Needs triage
	bionic	Needs triage
	focal	Released (1.40.0-1ubuntu0.2)
	jammy	Released (1.43.0-1ubuntu0.1)
	upstream	Needs triage
	mantic	Released (1.55.1-1ubuntu0.1)
	lunar	Released (1.52.0-1ubuntu0.1)
	Patches: upstream: https://github.com/nghttp2/nghttp2/pull/1961 upstream: https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832
golang Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	lunar	Does not exist
	upstream	Needs triage
	mantic	Does not exist
golang-1.6 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Needs triage
	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	lunar	Does not exist
	upstream	Needs triage
	mantic	Does not exist
golang-1.8 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Needs triage
	focal	Does not exist
	jammy	Does not exist
	lunar	Does not exist
	upstream	Needs triage
	mantic	Does not exist
golang-1.9 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Needs triage
	focal	Does not exist
	jammy	Does not exist
	lunar	Does not exist
	upstream	Needs triage
	mantic	Does not exist
golang-1.10 Launchpad, Ubuntu, Debian	trusty	Needs triage
	xenial	Needs triage
	bionic	Needs triage
	focal	Does not exist
	jammy	Does not exist
	lunar	Does not exist
	upstream	Needs triage
	mantic	Does not exist
golang-1.13 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Needs triage
	bionic	Needs triage
	focal	Needs triage
	jammy	Needs triage
	lunar	Does not exist
	upstream	Needs triage
	mantic	Does not exist
golang-1.14 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Does not exist
	focal	Needs triage
	jammy	Does not exist
	lunar	Does not exist
	upstream	Needs triage
	mantic	Does not exist
golang-1.16 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Needs triage
	focal	Needs triage
	jammy	Does not exist
	lunar	Does not exist
	upstream	Needs triage
	mantic	Does not exist
golang-1.17 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Does not exist
	focal	Does not exist
	jammy	Needs triage
	lunar	Does not exist
	upstream	Needs triage
	mantic	Does not exist
golang-1.18 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Needs triage
	bionic	Needs triage
	focal	Needs triage
	jammy	Needs triage
	lunar	Does not exist
	upstream	Needs triage
	mantic	Does not exist
golang-1.19 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	lunar	Needs triage
	upstream	Needs triage
	mantic	Does not exist
golang-1.20 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Does not exist
	focal	Needs triage
	jammy	Needs triage
	lunar	Needs triage
	upstream	Needs triage
	mantic	Needs triage
golang-1.21 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Does not exist
	upstream	Needs triage
	mantic	Needs triage
	focal	Needs triage
	jammy	Needs triage
	lunar	Needs triage
nodejs Launchpad, Ubuntu, Debian	trusty	Needs triage
	xenial	Needs triage
	bionic	Needs triage
	focal	Needs triage
	jammy	Needs triage
	lunar	Needs triage
	mantic	Needs triage
	upstream	Needs triage