Access Server: CVE-2023-44487 - Twisted HTTP/2 Denial-of-Service

Also Known As: HTTP/2 Rapid Reset Attack, HTTP/2 Stream Cancellation Attack

Impact on Access Server: Major

Details:

OpenVPN Access Server uses the Python Twisted library for web services. A vulnerability in this library could allow a remote attacker to launch a denial-of-service (DoS) attack. This vulnerability affects service availability but doesn't compromise the confidentiality of information.

Access Server versions 3.2.3 and earlier are vulnerable. The vulnerability is fixed in Access Server 3.2.4 and later versions.

Remediation:

Update Access Server to version 3.2.4 or newer.

Need Help?

If you have questions, submit a support ticket.