VMware NSX Advanced Load Balancer Response to CVE-2023-44487 - HTTP/2 protocol denial-of-service vulnerability

Products

• VMware

Issue/Introduction

A denial-of-service vulnerability in the HTTP/2 protocol was recently disclosed which could result in resource consumption of a vulnerable target.

Resolution

Quick Links:

• Is Avi affected by the CVE-2023-44487?
• What are the default protections within Avi against CVE-2023-44487?
• Documentation of the configuration

 

Is Avi affected by the CVE-2023-44487?

Avi as a Load Balancer supports connections via HTTP2.  This is an option on our Virtual Services which can be enabled.
Once enabled, Avi can be attacked via the CVE-2023-44487, but has by default the following protections in place.

 

What are the default protections within Avi against CVE-2023-44487?

Avi is protected from HTTP/2 attack by configuring the following parameters in the HTTP Application profile of the Virtual Service:

1. max_http2_concurrent_streams_per_connection

• Maximum number of concurrent streams over a client side HTTP/2 connection.

• Default Value: 128

• The recommended setting is to keep it at 128 concurrent streams per connection.

2. max_http2_requests_per_connection

• Maximum number of requests over a client side HTTP/2 connection.

• Default Value: 1000

• The recommended setting is to keep it at 1000 requests.

 

Documentation of the configuration

To learn more about the configuration of these settings, see HTTP/2 Support on NSX Advanced Load Balancer.