Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3883: It was found that encrypted connections did not honor the 'ioblocktimeout' parameter to end blocking requests. As a result, an unauthenticated attacker could repeatedly start a sufficient number of encrypted connections to block all workers, resulting in a denial of service. 1693612: CVE-2019-3883 389-ds-base: DoS via hanging secured connections
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | 389-ds-base | 0:1.3.8.4-25.1.amzn2.0.1 |
| Amazon Linux · 2 | 389-ds-base-debuginfo | 0:1.3.8.4-25.1.amzn2.0.1 |
| Amazon Linux · 2 | 389-ds-base-devel | 0:1.3.8.4-25.1.amzn2.0.1 |
| Amazon Linux · 2 | 389-ds-base-libs | 0:1.3.8.4-25.1.amzn2.0.1 |
| Amazon Linux · 2 | 389-ds-base-snmp | 0:1.3.8.4-25.1.amzn2.0.1 |
Vulnerabilities 1
-
Medium 5.3
In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worke…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-3883.html