Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3833: Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing specially crafted HTTP requests. A remote, unauthenticated attacker can exploit this vulnerability by sending malicious HTTP request to cause denial of service to openwsman server. 1674478: CVE-2019-3833 openwsman: Infinite loop in process_connection() allows denial of service
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libwsman-devel | 0:2.6.3-7.git4391e5c.amzn2 |
| Amazon Linux · 2 | libwsman1 | 0:2.6.3-7.git4391e5c.amzn2 |
| Amazon Linux · 2 | openwsman-client | 0:2.6.3-7.git4391e5c.amzn2 |
| Amazon Linux · 2 | openwsman-debuginfo | 0:2.6.3-7.git4391e5c.amzn2 |
| Amazon Linux · 2 | openwsman-perl | 0:2.6.3-7.git4391e5c.amzn2 |
| Amazon Linux · 2 | openwsman-python | 0:2.6.3-7.git4391e5c.amzn2 |
| Amazon Linux · 2 | openwsman-ruby | 0:2.6.3-7.git4391e5c.amzn2 |
| Amazon Linux · 2 | openwsman-server | 0:2.6.3-7.git4391e5c.amzn2 |
Vulnerabilities 1
-
High 7.5CVE-2019-3833 EPSS 15%
Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing spe…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-3833.html