Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-24553: Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header. 1874857: CVE-2020-24553 golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | golang | 0:1.15.3-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-bin | 0:1.15.3-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-docs | 0:1.15.3-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-misc | 0:1.15.3-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-race | 0:1.15.3-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-src | 0:1.15.3-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-tests | 0:1.15.3-1.amzn2.0.1 |
Vulnerabilities 1
-
Unscored —
Cross-site scripting in net/http/cgi and net/http/fcgi
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-24553.html