Skip to content

Disable HTTP/2 protocol in devfile/registry-support to mitigate CVE-2023-44487 (Rapid Reset) #1342

Closed
devfile/registry-support
#191
@rm3l

Description

@rm3l

/kind task
/area registry

This is a follow-up issue to #1315.

As commented out in #1315 (comment)_, it is strongly recommended, as one of the possible mitigation measures, to disable HTTP/2 endpoints if not needed: https://access.redhat.com/security/cve/CVE-2023-44487

And from this analysis, there seems to be currently only one repo where we need to do so:

  • devfile/registry-support: in the index/server folder, where an HTTP Server is started

The steps for disabling the HTTP/2 protocol in net/http are documented in https://pkg.go.dev/net/http#hdr-HTTP_2

Acceptance Criteria

  • Disable HTTP/2 protocol in servers started in the devfile/registry-support repo
  • Make sure it doesn't break the way existing clients interact with registries

Metadata

Metadata

Assignees

Labels

area/registryDevfile registry for stacks and infrastructurekind/task

Type

No type

Projects

Status

Done ✅

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions