MITRE: CVE-2023-44487 HTTP/2 Rapid Reset Attack

🔗 CVE IDs covered (1)

🎯 Affected products29

• .NET 6.0
• .NET 7.0
• ASP.NET Core 6.0
• ASP.NET Core 7.0
• Microsoft Visual Studio 2022 version 17.2
• Microsoft Visual Studio 2022 version 17.4
• Microsoft Visual Studio 2022 version 17.6
• Microsoft Visual Studio 2022 version 17.7
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 version 21H2 for ARM64-based Systems
• Windows 11 version 21H2 for x64-based Systems
• Windows Server 2016
• Windows Server 2016 (Server Core installation)
• Windows Server 2019
• Windows Server 2019 (Server Core installation)
• Windows Server 2022
• Windows Server 2022 (Server Core installation)

✅ Remediation

KB5032874 (Security Update) — fixed build 6.0.24 KBRelease Notes (Security Update) — fixed build 6.0.24 KB5032875 (Security Update) — fixed build 7.0.13 KBRelease Notes (Security Update) — fixed build 17.2.21 KBRelease Notes (Security Update) — fixed build 17.4.13 KBRelease Notes (Security Update) — fixed build 17.6.9 KBRelease Notes (Security Update) — fixed build 17.7.6 KB5031361 (Security Update) — fixed build 10.0.17763.4974 KB5031364 (Security Update) — fixed build 10.0.20348.2031 KB5031358 (Security Update) — fixed build 10.0.22000.2538 KB5031356 (Security Update) — fixed build 10.0.19044.3570 KB5031354 (Security Update) — fixed build 10.0.22621.2428 KB5031356 (Security Update) — fixed build 10.0.19045.3570 KB5031362 (Security Update) — fixed build 10.0.14393.6351 KBRelease Notes (Security Update) — fixed build 7.0.13

🔗 References (26)

• advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487
• patchhttps://dotnet.microsoft.com/download/dotnet/6.0
• referencehttps://support.microsoft.com/help/5032874
• referencehttps://github.com/dotnet/aspnetcore/issues/51264
• patchhttps://dotnet.microsoft.com/en-us/download/dotnet/7.0
• referencehttps://support.microsoft.com/help/5032875
• patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.2
• referencehttps://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes
• patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.4
• referencehttps://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
• patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.6
• patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.7
• patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5031361
• referencehttps://support.microsoft.com/help/5031361
• patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5031364
• referencehttps://support.microsoft.com/help/5031364
• referencehttp://support.microsoft.com/help/5031364
• patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5031358
• referencehttps://support.microsoft.com/help/5031358
• patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5031356
• referencehttps://support.microsoft.com/help/5031356
• patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5031354
• referencehttps://support.microsoft.com/help/5031354
• patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5031362
• referencehttps://support.microsoft.com/help/5031362
• patchhttps://dotnet.microsoft.com/download/dotnet/7.0