[CASSANDRA-18943] http/2 vulnerability: CVE-2023-44487

• Type: Bug
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 3.0.30, 3.11.17, 4.0.12, 4.1.4, 5.0-alpha2, 5.0, 5.1
• Component/s: Dependencies
• Bug Category: Security - Denial of Service
• Severity: Normal
• Complexity: Normal
• Discovered By: User Report
• Platform: All
• Since Version: NA

Source Control Link

https://github.com/apache/cassandra/commit/5bf1d2f8d5b6b37b8f6e2718f85dec068ceb7206

Test and Documentation Plan

run CI

• Assignee: Brandon Williams
• Reporter: Brandon Williams

Authors

Brandon Williams

Reviewers

Berenguer Blasi

• Created: 19/Oct/23 11:02
• Updated: 01/Nov/23 08:54
• Resolved: 26/Oct/23 11:09

Description

https://nvd.nist.gov/vuln/detail/CVE-2023-44487

Basically anything using http/2 is covered by this, but we don't use it.