漏洞扫描漏洞详情接口 枚举参数 无 请求示例 请求url 无 请求头header {"regionid": "100054c0416811e9a6690242ac110002","ContentType":"application/json","urlType": "CTAPI"} 请求体body {"vulAnnouncementId":"CTyunOSSA202341697","currentPage":1,"pageSize":10} 响应示例 { "statusCode": "200", "error": "CTCSSCN000000", "message": "查询成功!", "returnObj":{ "title": "CTyunOSSA202341697: nghttp2 security update", "vulAnnouncementId": "CTyunOSSA202341697", "vulType": "LINUX", "publishAt": "20231013", "description": "CTyunOSSA202341697: nghttp2 security update", "url": " /support/safetyDetail?idCTyunOSSA202341697", "cveDetailPageInfo": { "total": 1, "list": { "cveId": "CVE202344487", "vulAnnouncementId": "CTyunOSSA202341697", "title": "HTTP/2 Rapid Reset 拒绝服务漏洞 (CVE202344487)", "publishAt": "20231013", "description": "HTTP/2协议允许客户端通过发送RSTSTREAM帧来指示服务器应该取消之前的流。该协议允许客户端单方面请求取消,这种攻击被称为快速重置。在HTTP/2快速重置攻击中,客户端一次打开大量流,但不等待服务器或代理对每个请求流的响应,而是立即取消每个请求,通过大规模利用请求取消请求取消快速重置攻击,会导致服务器CPU资源快速消耗,达到DoS。", "url": "[ "solution": "协议漏洞,建议关闭HTTP/2协议,降级到HTTP/1.1,或更新各类产品相关安全设置,比如nginx默认配置下最多保持1000个HTTP连接,只要服务器性能不太差默认配置下不受该漏洞影响;而jetty则受漏洞影响,需要更新至最新安全版本。", "vulLabel": "未加控制的资源消耗(资源穷尽)", "rebootRequired": false, "ratingLevel": 3 } ], "pageNum": 1, "pageSize": 10, "size": 0, "startRow": 0, "endRow": 0, "pages": 0, "prePage": 0, "nextPage": 0, "isFirstPage": false, "isLastPage": false, "hasPreviousPage": false, "hasNextPage": false, "navigatePages": 0, "navigatepageNums": null, "navigateFirstPage": 0, "navigateLastPage": 0 } } }