Sign in Sign up
JA · EN · FR
SecPulse
← Back
CVE-2023-44487 CISA KEV high CVSS 7.5

[KEV] Vulnerability in Ietf golang.org/x/net (CVE-2023-44487)

Summary

vulnerability in Ietf golang.org/x/net (CVE-2023-44487). Risk of unauthorized operations or information disclosure. Exploitable via ``Channel``. Listed in CISA KEV — actively exploited. Mitigation: upgrade to `0.17.0` or later.

AI summary snake-internal / snake-material-v2

A vulnerability tracked as **CVE-2023-44487** has been found in Ietf golang.org/x/net. Attackers can target a specific entry point like ``Channel`` over the network to misuse the product. Risk of unauthorized operations or information disclosure. CVSS score: 7.5/10. Note: CISA has officially confirmed this is **actively exploited in the wild**. Treat it with elevated urgency. What to do: upgrade Ietf golang.org/x/net to **0.17.0** or later. If unsure, ask your IT team or search "Ietf golang.org/x/net CVE-2023-44487" on the vendor's site.
CVE-2023-44487 (Ietf golang.org/x/net) — CWE-400 / CVSS v3 7.5 Attack vector: remote (network-reachable) / unauthenticated / no user interaction Attack surface: `Channel` / `EventLoop` Patched: `0.17.0` — apply immediately Listed in CISA KEV — actively exploited, treat as top priority. Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs. Refs: see the GHSA / vendor advisory / patched release linked on this page.
❓ What is the problem
**A vulnerability** (CWE-400) exists in Ietf golang.org/x/net. Attackers reach the vulnerable code path via ``Channel`` without authentication.
📍 Affected scope
Ietf golang.org/x/net — . Attack surface: `Channel` / `EventLoop`.
🔥 Severity
Severity: High (CVSS 7.5/10). Risk of unauthorized operations or information disclosure **Listed in CISA KEV** — actively exploited in the wild, treat as top priority.
🔧 How to fix
Update to **0.17.0**.
🛡️ Workaround
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
🔍 Detection
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run `grep -r 'golang.org/x/net' .` against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response Actions (7 steps)

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'golang.org/x/net' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で `golang.org/x/net` を grep し、稼働しているサービス・バージョンを把握する。

  2. 4
    Consider incident declaration escalate 
    Notify SOC / on-call

    CISA KEV登録済 = 実環境で悪用が観測されている。Step 3 で兆候があればインシデント対応宣言、無くてもパッチ適用までWAF強化を最優先で。

  3. 6
    Apply patch patch 
    Upgrade golang.org/x/net to 0.17.0

    ステージング環境で 0.17.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスと、Step 3 で見つけた異常検知の続報チェックを含めること。

  4. 7
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Affected packages

go golang.org/x/net
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.17.0"}]}]
maven org.apache.tomcat.embed:tomcat-embed-core
[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.94"}]}]
swift github.com/apple/swift-nio-http2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0"}]}]
maven org.eclipse.jetty.http2:http2-common
[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.17"}]}]
maven org.eclipse.jetty.http2:http2-server
[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.17"}]}]
maven org.eclipse.jetty.http2:jetty-http2-common
[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.2"}]}]
maven org.eclipse.jetty.http2:jetty-http2-server
[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.2"}]}]
maven com.typesafe.akka:akka-http-core
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.3"}]}]
maven com.typesafe.akka:akka-http-core_2.13
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.3"}]}]
maven com.typesafe.akka:akka-http-core_2.12
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.3"}]}]
maven com.typesafe.akka:akka-http-core_2.11
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"10.1.15"}]}]
maven org.apache.tomcat:tomcat-coyote
[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.94"}]}]
Bitnami nginx-ingress-controller
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.3"}]}]
Bitnami apisix
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.1"}]}]
Bitnami aspnet-core
[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.0.23"},{"introduced":"7.0.0"},{"fixed":"7.0.12"}]}]
Bitnami contour
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.24.6"}]}]
Bitnami dotnet-sdk
[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.0.23"},{"introduced":"7.0.0"},{"fixed":"7.0.12"}]}]
Bitnami dotnet
[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.0.23"},{"introduced":"7.0.0"},{"fixed":"7.0.12"}]}]
Bitnami envoy
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.24.12"},{"introduced":"1.25.0"},{"fixed":"1.25.11"},{"introduced":"1.26.0"},{"fixed":"1.26.6"},{"introduced":"1.27.0"},{"fixed":"1.27.2"}]}]
Bitnami golang
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.20.10"},{"introduced":"1.21.0-0"},{"fixed":"1.21.3"}]}]
Bitnami nginx-gateway
[{"type":"SEMVER","events":[{"introduced":"1.9.5"},{"fixed":"1.25.3"}]}]
Bitnami nginx
[{"type":"SEMVER","events":[{"introduced":"1.9.5"},{"fixed":"1.25.3"}]}]
Bitnami node-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.18.2"},{"introduced":"19.0.0"},{"fixed":"20.8.1"}]}]
Bitnami node
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.18.2"},{"introduced":"19.0.0"},{"fixed":"20.8.1"}]}]
Bitnami jenkins
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.414.3"},{"introduced":"2.415.0"},{"fixed":"2.428.0"}]}]
Bitnami tomcat
[{"type":"SEMVER","events":[{"introduced":"8.5.0"},{"fixed":"8.5.94"},{"introduced":"9.0.0"},{"fixed":"9.0.81"},{"introduced":"10.0.0"},{"fixed":"10.1.14"}]}]
Bitnami varnish
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.0.12"},{"introduced":"6.1.0"},{"fixed":"7.3.1"},{"introduced":"7.4.0"},{"fixed":"7.4.2"}]}]
SwiftURL github.com/apple/swift-nio-http2
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.28.0"}]}]
Bitnami kong
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.2"}]}]
Bitnami solr
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.4.0"}]}]

References

🍪 About cookies

We use cookies to keep you logged in, remember your language, and improve the service.

Details →