CVE-2023-44487 - Denial of Service (DoS)

Severity: High2024-01-30

Abstract

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

The Oxygen products incorporate Netty as a third-party libraries. This advisory was opened to address the potential impact of this third-party libraries vulnerability.

Affected Products/Versions

Product	Severity	Fixed Release Availability
Oxygen Content Fusion v5.1.2 and older	Low	Oxygen Content Fusion 6.0 build 2023110109
Oxygen Publishing Engine v26.0 and older	None	N/A
Oxygen XML Web Author v26.0.0 and older	High	Oxygen Web Author 26.0.0.1 build 2024022608

Mitigation

None

Detail

CVE-2023-44487

Severity: Critical

CVSS Score: 7.5

The netty third-party libraries used by Oxygen XML products are an affected version mentioned in CVE-2023-44487 vulnerability description. However, Oxygen Content Fusion uses the Netty library only for internal network. For that reason we rated this vulnerability as low.

Revision History

2024-03-07 Starting with Oxygen XML Web Author version 26.0.0.1 build 2024022608, the Apache Tomcat was updated to version 9.0.85, which includes a fix for CVE-2023-44487.

List of Security Advisories