Search threats, CVEs… ⌘K
Back to vendor advisories
Microsoft Security Response CenterCVE-2023-45288

HTTP/2 CONTINUATION flood in net/http

HighVendor CVSS 7.5 / 10 1 CVE Published Apr 8, 2024 at 12:00 AM UTC
Get alerts for azl3 application-gateway-kubernetes-ingress 1.7.2-3 on Azure Linux

Summary

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?

One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information.

If impact to additional products is identified, we will update the CVE to reflect this.

Products covered

  • azl3 application-gateway-kubernetes-ingress 1.7.2-3 on Azure Linux 3.0

  • azl3 etcd 3.5.12-2 on Azure Linux 3.0

  • azl3 docker-cli 25.0.3-3 on Azure Linux 3.0

  • azl3 containerd 1.7.13-8 on Azure Linux 3.0

  • azl3 telegraf 1.29.4-1 on Azure Linux 3.0

  • azl3 prometheus-node-exporter 1.7.0-3 on Azure Linux 3.0

  • azl3 cert-manager 1.11.2-8 on Azure Linux 3.0

  • azl3 moby-containerd-cc 1.7.7-9 on Azure Linux 3.0

Show 112 more products

  • azl3 docker-compose 2.24.6-2 on Azure Linux 3.0

  • azl3 git-lfs 3.4.1-1 on Azure Linux 3.0

  • azl3 flannel 0.24.2-14 on Azure Linux 3.0

  • azl3 containerized-data-importer 1.57.0-14 on Azure Linux 3.0

  • azl3 prometheus-adapter 0.11.2-1 on Azure Linux 3.0

  • azl3 kubevirt 1.2.0-17 on Azure Linux 3.0

  • azl3 moby-engine 25.0.3-13 on Azure Linux 3.0

  • azl3 influxdb 2.7.5-5 on Azure Linux 3.0

  • azl3 cri-tools 1.29.0-1 on Azure Linux 3.0

  • azl3 helm 3.13.2-3 on Azure Linux 3.0

  • cbl2 packer 1.9.5-5 on CBL Mariner 2.0

  • cbl2 kata-containers-cc 3.2.0.azl2-6 on CBL Mariner 2.0

  • cbl2 moby-containerd 1.6.26-11 on CBL Mariner 2.0

  • cbl2 moby-engine 24.0.9-16 on CBL Mariner 2.0

  • cbl2 kubevirt 0.59.0-28 on CBL Mariner 2.0

  • cbl2 moby-containerd-cc 1.7.7-11 on CBL Mariner 2.0

  • cbl2 nmi 1.8.17-1 on CBL Mariner 2.0

  • cbl2 kured 1.14.2-5 on CBL Mariner 2.0

  • cbl2 node-problem-detector 0.8.17-6 on CBL Mariner 2.0

  • cbl2 telegraf 1.29.4-15 on CBL Mariner 2.0

  • cbl2 multus 4.0.2-7 on CBL Mariner 2.0

  • cbl2 opa 0.63.0-4 on CBL Mariner 2.0

  • azl3 kata-containers 3.2.0.azl3-2 on Azure Linux 3.0

  • azl3 kata-containers-cc 3.2.0.azl3-1 on Azure Linux 3.0

  • azl3 prometheus 2.45.4-12 on Azure Linux 3.0

  • cbl2 git-lfs 3.5.1-5 on CBL Mariner 2.0

  • cbl2 moby-cli 24.0.9-6 on CBL Mariner 2.0

  • cbl2 azcopy 10.24.0-3 on CBL Mariner 2.0

  • azl3 multus 4.0.2-5 on Azure Linux 3.0

  • cbl2 prometheus 2.37.9-4 on CBL Mariner 2.0

  • cbl2 helm 3.14.2-5 on CBL Mariner 2.0

  • cbl2 packer 1.9.5-5 on CBL-Mariner 2.0

  • cbl2 kata-containers-cc 3.2.0.azl2-6 on CBL-Mariner 2.0

  • cbl2 moby-engine 24.0.9-16 on CBL-Mariner 2.0

  • cbl2 kubernetes 1.28.4-17 on CBL-Mariner 2.0

  • cbl2 vitess 16.0.2-9 on CBL-Mariner 2.0

  • cbl2 kubevirt 0.59.0-28 on CBL-Mariner 2.0

  • cbl2 moby-compose 2.17.3-10 on CBL-Mariner 2.0

  • cbl2 cert-manager 1.11.2-22 on CBL-Mariner 2.0

  • cbl2 kured 1.14.2-5 on CBL-Mariner 2.0

  • cbl2 skopeo 1.14.2-10 on CBL-Mariner 2.0

  • cbl2 etcd 3.5.12-6 on CBL-Mariner 2.0

  • cbl2 coredns 1.11.1-18 on CBL-Mariner 2.0

  • cbl2 telegraf 1.29.4-15 on CBL-Mariner 2.0

  • cbl2 multus 4.0.2-7 on CBL-Mariner 2.0

  • cbl2 opa 0.63.0-4 on CBL-Mariner 2.0

  • cbl2 azcopy 10.24.0-3 on CBL-Mariner 2.0

  • cbl2 prometheus 2.37.9-4 on CBL-Mariner 2.0

  • cbl2 prometheus 2.37.9-2 on CBL Mariner 2.0

  • cbl2 nmi 1.8.17-3 on CBL Mariner 2.0

  • cbl2 azcopy 10.24.0-1 on CBL Mariner 2.0

  • cbl2 moby-cli 24.0.9-3 on CBL Mariner 2.0

  • cbl2 git-lfs 3.5.1-1 on CBL Mariner 2.0

  • cbl2 opa 0.63.0-2 on CBL Mariner 2.0

  • cbl2 multus 4.0.2-3 on CBL Mariner 2.0

  • cbl2 telegraf 1.29.4-3 on CBL Mariner 2.0

  • cbl2 node-problem-detector 0.8.17-3 on CBL Mariner 2.0

  • cbl2 coredns 1.11.1-8 on CBL Mariner 2.0

  • cbl2 cri-tools 1.29.0-2 on CBL Mariner 2.0

  • cbl2 etcd 3.5.12-2 on CBL Mariner 2.0

  • cbl2 skopeo 1.14.2-3 on CBL Mariner 2.0

  • cbl2 kured 1.14.2-3 on CBL Mariner 2.0

  • cbl2 cert-manager 1.11.2-9 on CBL Mariner 2.0

  • cbl2 moby-compose 2.17.3-3 on CBL Mariner 2.0

  • cbl2 nmi 1.8.17-2 on CBL Mariner 2.0

  • cbl2 helm 3.14.2-2 on CBL Mariner 2.0

  • cbl2 moby-containerd-cc 1.7.7-4 on CBL Mariner 2.0

  • cbl2 kubevirt 0.59.0-16 on CBL Mariner 2.0

  • cbl2 vitess 16.0.2-8 on CBL Mariner 2.0

  • cbl2 kubernetes 1.28.4-7 on CBL Mariner 2.0

  • cbl2 kata-containers 3.2.0.azl2-1 on CBL Mariner 2.0

  • cbl2 moby-engine 24.0.9-2 on CBL Mariner 2.0

  • cbl2 moby-containerd 1.6.26-5 on CBL Mariner 2.0

  • cbl2 kata-containers-cc 3.2.0.azl2-1 on CBL Mariner 2.0

  • cbl2 packer 1.10.1-2 on CBL Mariner 2.0

  • cbl2 blobfuse2 2.1.2-3 on CBL Mariner 2.0

  • cbl2 sriov-network-device-plugin 3.6.2-3 on CBL Mariner 2.0

  • azl3 multus 4.0.2-3 on Azure Linux 3.0

  • azl3 prometheus 2.45.4-4 on Azure Linux 3.0

  • azl3 kata-containers-cc 3.2.0.azl4-1 on Azure Linux 3.0

  • azl3 kata-containers 3.2.0.azl4-1 on Azure Linux 3.0

  • azl3 ig 0.29.0-1 on Azure Linux 3.0

  • azl3 helm 3.15.2-1 on Azure Linux 3.0

  • azl3 cri-tools 1.30.1-1 on Azure Linux 3.0

  • azl3 influxdb 2.7.3-6 on Azure Linux 3.0

  • azl3 opa 0.63.0-1 on Azure Linux 3.0

  • azl3 moby-engine 25.0.3-10 on Azure Linux 3.0

  • azl3 kubevirt 1.2.0-13 on Azure Linux 3.0

  • azl3 azcopy 10.25.1-1 on Azure Linux 3.0

  • azl3 prometheus-adapter 0.12.0-1 on Azure Linux 3.0

  • azl3 containerized-data-importer 1.57.0-11 on Azure Linux 3.0

  • azl3 gh 2.62.0-1 on Azure Linux 3.0

  • azl3 flannel 0.24.2-10 on Azure Linux 3.0

  • azl3 vitess 19.0.4-2 on Azure Linux 3.0

  • azl3 kube-vip-cloud-provider 0.0.10-1 on Azure Linux 3.0

  • azl3 libcontainers-common 20240213-2 on Azure Linux 3.0

  • azl3 git-lfs 3.6.1-1 on Azure Linux 3.0

  • azl3 node-problem-detector 0.8.15-4 on Azure Linux 3.0

  • azl3 docker-compose 2.27.0-1 on Azure Linux 3.0

  • azl3 moby-containerd-cc 1.7.7-6 on Azure Linux 3.0

  • azl3 cert-manager 1.12.12-1 on Azure Linux 3.0

  • azl3 local-path-provisioner 0.0.24-3 on Azure Linux 3.0

  • azl3 prometheus-node-exporter 1.7.0-2 on Azure Linux 3.0

  • azl3 telegraf 1.31.0-1 on Azure Linux 3.0

  • azl3 containerd 1.7.13-6 on Azure Linux 3.0

  • azl3 coredns 1.11.1-2 on Azure Linux 3.0

  • azl3 docker-cli 25.0.7-1 on Azure Linux 3.0

  • azl3 blobfuse2 2.3.0-1 on Azure Linux 3.0

  • azl3 cf-cli 8.7.3-6 on Azure Linux 3.0

  • azl3 kured 1.15.0-2 on Azure Linux 3.0

  • azl3 etcd 3.5.18-1 on Azure Linux 3.0

  • azl3 docker-buildx 0.14.0-1 on Azure Linux 3.0

Remediation

CBL-Mariner Releases

Vendor-listed fixes

  • 1.7.7-1

  • 3.5.18-1

  • 25.0.7-1

  • 1.7.13-6

  • 1.31.0-1

  • 1.7.0-2

  • 1.12.12-1

  • 1.7.7-6

Show 56 more fixes

  • 2.27.0-1

  • 3.6.1-1

  • 0.24.2-10

  • 1.57.0-11

  • 0.12.0-1

  • 1.2.0-13

  • 25.0.3-10

  • 2.7.3-6

  • 1.30.1-1

  • 3.15.2-1

  • 1.10.1-2

  • 3.2.0.azl2-1

  • 1.6.26-5

  • 24.0.9-2

  • 0.59.0-16

  • 1.7.7-4

  • 1.8.17-2

  • 1.14.2-3

  • 0.8.17-3

  • 1.29.4-3

  • 4.0.2-3

  • 0.63.0-2

  • 3.2.0.azl4-1

  • 2.45.4-4

  • 3.5.1-1

  • 24.0.9-3

  • 10.25.1-1

  • 2.37.9-2

  • 3.14.2-2

  • 1.28.4-7

  • 16.0.2-8

  • 2.17.3-3

  • 1.11.2-9

  • 3.5.12-2

  • 1.11.1-8

  • 10.24.0-1

  • 1.8.17-3

  • 1.29.0-2

  • 2.1.2-3

  • 3.6.2-3

  • 0.29.0-1

  • 0.63.0-1

  • 2.62.0-1

  • 19.0.4-2

  • 0.0.10-1

  • 20240213-2

  • 0.8.15-4

  • 0.0.24-3

  • 1.11.1-2

  • 2.3.0-1

  • 8.7.3-6

  • 1.15.0-2

  • 0.14.0-1

  • 3.10.116-2

  • 1.14.4-3

  • 1.9.5-7

CVEs in this advisory 1

CVE-2023-45288
Update history

What changed in later vendor updates

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

    • The vendor changed the advisory's last-updated date.

Updates

  1. Published by Microsoft Security Response Center

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.

  3. Updated by Microsoft Security Response Center

    The vendor changed the advisory after it was first published.

  4. Confirmed at the source

    Our collector saw this advisory during a later source check.

Keep investigating
See every advisory from this vendor
More from this vendor

Uncontrolled search path for the libva software for all versions within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVE-2026-56438