CVE-2023-45288

一、漏洞信息
 漏洞编号：[CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288)
 漏洞归属组件：[kubevirt](https://gitee.com/src-openeuler/kubevirt)
 漏洞归属的版本：0.54.0
 CVSS V2.0分值：
  BaseScore：N/A None
  Vector：CVSS：2.0/
 漏洞简述：
  An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request s headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.
 漏洞公开时间：2024-04-05 05:15:16
 漏洞创建时间：2024-04-04 02:17:40
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-45288
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| security.golang.org | http://www.openwall.com/lists/oss-security/2024/04/03/16 |  |
| security.golang.org | http://www.openwall.com/lists/oss-security/2024/04/05/4 |  |
| security.golang.org | https://go.dev/cl/576155 |  |
| security.golang.org | https://go.dev/issue/65051 |  |
| security.golang.org | https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/ |  |
| security.golang.org | https://pkg.go.dev/vuln/GO-2024-2687 |  |
| security.golang.org | https://security.netapp.com/advisory/ntap-20240419-0009/ |  |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:1668 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:1679 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:1681 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:1683 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:1963 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:1962 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2060 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2062 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:1899 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:1892 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:1897 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2079 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2088 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2562 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2625 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2068 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2049 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2699 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2724 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2664 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2667 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2668 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2672 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2671 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2773 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2782 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2936 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2935 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2865 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2941 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3259 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2729 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2933 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3314 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3316 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3315 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2929 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2932 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2930 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3352 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3346 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2875 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3467 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3327 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2728 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3479 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3331 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3621 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3680 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3523 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3781 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3889 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3885 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4023 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4034 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4010 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4041 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4125 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4126 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4146 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4006 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:1616 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3637 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4543 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4546 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4545 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4484 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4677 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4699 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4922 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4933 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4934 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4982 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4960 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:6221 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:6004 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:6406 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:6642 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:6811 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:7164 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:8235 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:8425 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:8688 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:8692 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2025:0832 | https://bugzilla.redhat.com/show_bug.cgi?id=2268273 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-45288 |
| oracle |  | https://www.oracle.com/security-alerts/cpuoct2024.html |
| gentoo |  | https://security.gentoo.org/glsa/202408-07 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2023-45288 |
| cve_search |  | https://go.dev/issue/65051 |
| cve_search |  | https://go.dev/cl/576155 |
| cve_search |  | https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/golang/net/commit/ba872109ef2dc8f1da778651bd1fd3792d0e4587 |  | snyk |
|  |  | https://github.com/traefik/traefik/commit/099c7e9444a5d56918b8221672fc8d6a09a5d389 |  | snyk |

</details>
 
二、漏洞分析结构反馈
 影响性分析说明：
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  
 openEuler评分：
   
 受影响版本排查(受影响/不受影响)：
  1.master(1.2.0):
2.openEuler-20.03-LTS-SP1:
3.openEuler-20.03-LTS-SP4:
4.openEuler-22.03-LTS:
5.openEuler-22.03-LTS-Next:
6.openEuler-22.03-LTS-SP1:
7.openEuler-22.03-LTS-SP2:
8.openEuler-22.03-LTS-SP3:
9.openEuler-24.03-LTS:
10.openEuler-24.03-LTS-Next:
11.openEuler-22.03-LTS-SP4:

修复是否涉及abi变化(是/否)：
  1.master(1.2.0):
2.openEuler-20.03-LTS-SP1:
3.openEuler-20.03-LTS-SP4:
4.openEuler-22.03-LTS:
5.openEuler-22.03-LTS-Next:
6.openEuler-22.03-LTS-SP1:
7.openEuler-22.03-LTS-SP2:
8.openEuler-22.03-LTS-SP3:
9.openEuler-24.03-LTS:
10.openEuler-24.03-LTS-Next:

原因说明：
  1.master(1.2.0):
2.openEuler-20.03-LTS-SP4:
3.openEuler-22.03-LTS-SP3:
4.openEuler-22.03-LTS-SP4:
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

src-openEuler/kubevirt

内容风险标识

评论 (2)

src-openEuler/kubevirt .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-45288

评论 (2)

搜索帮助

src-openEuler/kubevirt