Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1000115: It was discovered that the memcached connections using UDP transport protocol can be abused for efficient traffic amplification distributed denial of service (DDoS) attacks. A remote attacker could send a malicious UDP request using a spoofed source IP address of a target system to memcached, causing it to send a significantly larger response to the target. 1551182: CVE-2018-1000115 memcached: UDP server support allows spoofed traffic amplification DoS
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | memcached | 0:1.4.15-10.amzn2.1.1 |
| Amazon Linux · 2 | memcached-debuginfo | 0:1.4.15-10.amzn2.1.1 |
| Amazon Linux · 2 | memcached-devel | 0:1.4.15-10.amzn2.1.1 |
Vulnerabilities 1
-
Unscored —
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vul…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-1000115.html