Synology-SA-23:14 HTTP/2 Rapid Reset Attack
Publish Time: 2023-10-13 14:13:17 UTC+8
Last Updated: 2023-10-13 14:13:17 UTC+8
- Severity
- Not affected
- Status
- Resolved
Abstract
None of Synology's products are affected by CVE-2023-44487.
Affected Products
| Product | Severity | Fixed Release Availability |
|---|---|---|
| DSM 7.2 | Not affected | N/A |
| DSM 7.1 | Not affected | N/A |
| DSM 6.2 | Not affected | N/A |
| DSMUC 3.1 | Not affected | N/A |
| SRM 1.3 | Not affected | N/A |
| VS Firmware 3.0 | Not affected | N/A |
Mitigation
None
Detail
- CVE-2023-44487
- Severity: Not affected
- CVSS3 Base Score: 0.0
- CVSS3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
- The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Reference
Revision
| Revision | Date | Description |
|---|---|---|
| 1 | 2023-10-13 | Initial public release. |