Intel

CVE-2023-44487

Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes 2.11.9 security update

criticalKEV: actively exploitedPoCEPSS 100%

Description

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Source: BSI_CSAFBSIBSI_CSAFBSIBSIBSI_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFBSI_CSAFBSISIEMENS_ADVISORYOSVOSVOSVREDHAT_CSAFOSVOSVOSVOSVOSVOSVOSVCISA_KEVNVDCVEORGSIEMENS_ADVISORYSIEMENS_ADVISORYSIEMENS_ADVISORYSIEMENS_ADVISORYBSI_CSAFBSIOSVOSVOSVOSVOSVOSVOSVOSVOSVOSVOSVOSVOSVOSVCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2023-44487 carries an EPSS score at the 100th percentile, making it statistically the most likely CVE in the entire catalogue to see active exploitation attempts — the attack is trivially automatable, requires no authentication (CVSS PR:N/UI:N), and is reachable over the network with no preconditions (AV:N/AC:L). The impact is confined to availability (C:N/I:N/A:H), but for NIS2-scoped KRITIS organisations this is precisely the dimension that triggers Article 21 obligations, since Planning Analytics Local is typically embedded in financial planning, controlling, and supply-chain reporting workflows where downtime directly disrupts core operational processes. The CISA KEV flag without a ransomware-campaign indicator means the primary threat model is targeted or opportunistic DoS rather than data encryption, but the patch priority remains high because the attack surface is defined by the protocol implementation itself and cannot be fully eliminated through configuration alone.

Runbook · Step 1

Immediate response (0-24 h)

  • Update IBM Planning Analytics Local to version 2.1.23 or later — retrieve the exact patch from IBM Fix Central / IBM Support Portal; all instances below 2.1.23 are vulnerable.
  • If patching cannot be completed immediately, disable HTTP/2 on the Planning Analytics frontend listener and fall back to HTTP/1.1, provided operational requirements permit.
  • Audit all upstream components that terminate HTTP/2 (nginx, HAProxy, F5, CDN edges) independently of IBM PA — patch them to versions that include Rapid Reset mitigations (nginx 1.25.3+, Apache httpd 2.4.58+, HAProxy 2.8.4+).
  • Enable rate-limiting for incoming HTTP/2 HEADERS and RST_STREAM frames on all exposed endpoints; cap maximum concurrent streams per connection to a conservative value (e.g. 100).
  • Network perimeter: restrict access to Planning Analytics web ports (default TCP 9510, 9511, 443) to known source IP ranges or VPN gateways if public exposure is not strictly required.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Place Planning Analytics instances behind a WAF or reverse proxy that implements Rapid Reset protection; ensure the proxy itself is patched to a fixed version before relying on it as a control.
  • WAF/IPS rule: Enable or create a Suricata signature for excessive RST_STREAM frames — pattern: high volume of Frame-Type 0x3 frames within a short window on a single TCP connection; suggested threshold: > 50 RST_STREAM/s per source IP. alert http2 any any -> $HTTP_SERVERS any (msg:"CVE-2023-44487 Rapid Reset"; flow:established,to_server; http2.frame_type:3; threshold:type threshold,track by_src,count 100,seconds 10; sid:9000001;)
  • HTTP/2 stream limits: Set http2_max_concurrent_streams 64 in nginx; H2MaxSessionStreams 64 in Apache httpd; max-concurrent-streams 64 in HAProxy frontend blocks.
  • Upstream DDoS scrubbing: Activate an upstream scrubbing service (e.g. Cloudflare, Akamai, or on-premises DDoS mitigation appliance) to absorb volumetric Rapid Reset floods before they reach the application stack.
  • Resource limits / least privilege: Ensure Planning Analytics services run without elevated OS privileges; apply ulimit and cgroup constraints to contain the blast radius of a resource-exhaustion attack on the host.
  • Timeout hardening: Configure aggressive idle-connection timeouts and keep-alive limits on the reverse proxy to reclaim resources from half-open connections quickly.

Runbook · Step 3

Detection rules

  • Network telemetry (Zeek/Suricata): Alert on > 100 HTTP/2 RST_STREAM frames (Frame-Type 0x3) from a single source IP within 10 seconds on ports 443/9510/9511 — see Suricata SID example in Mitigation layers above.
  • Web server access logs: Spike in HTTP 499 or HTTP 408 responses (client-side connection resets) combined with a high request rate and few completed responses — SPL: index=webserver status IN (499,408) | timechart span=10s count by src_ip | where count > 500
  • System resources (Linux auditd / Prometheus): Sudden surge in CPU utilisation and open file-descriptor count on the Planning Analytics process without a corresponding rise in legitimate user activity; check auditd SYSCALL records for unexpected child-process spawns.
  • EDR process tree: Unexpected process spawns or OOM-killer events (kernel: Out of memory: Kill process) in the context of the Planning Analytics service — KQL: event.type:"process_started" AND process.parent.name:"pawebservice" AND NOT process.name:("java" OR "node")
  • Connection count monitoring: Alert via netstat/ss polling when > 500 simultaneous ESTABLISHED connections to PA ports originate from a single source IP.

Metrics

Severity
critical
Priority score
221.52
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
7.5
Source: nvd-v3
CVSS v3
7.5
CVSS v4
—
EPSS percentile
100.0 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
100.0 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2025-12-17 14:58 UTC
CWE
—

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CPE Deprecation Remap2026-08-11 19:37 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* versions from (excluding) 7.4.2 → OR *cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:* versions from (excluding) 7.4.2

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • mobile

    cisco / ios_xe

  • mobile

    cisco / ios_xr

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    cisco / fog_director

  • other

    cisco / nx-os

  • other

    siemens / ruggedcom_ape1808_firmware

  • other

    cisco / secure_web_appliance_firmware

  • other

    siemens / simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware

  • other

    siemens / simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware

  • other

    siemens / siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware

  • windows

    microsoft / windows_10_1607

  • windows

    microsoft / windows_10_1809

  • windows

    microsoft / windows_10_21h2

  • windows

    microsoft / windows_10_22h2

  • windows

    microsoft / windows_11_21h2

  • windows

    microsoft / windows_11_22h2

  • windows

    microsoft / windows_server_2016

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • bitnami

    varnish6.1.0

  • bitnami

    varnish7.4.0

  • go

    github.com/operator-framework/operator-sdk

  • npm

    cipher-base

  • npm

    form-data3.0.0

  • npm

    form-data4.0.0

  • npm

    form-data

  • npm

    sha.js

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

IDCVE-2023-44487