Skip to content
OpenAdvisories
Medium ALAS2-2021-1657 1 CVE

Moderate: golang security update (Amazon Linux 2)

Published Jun 16, 2021 · Updated Jun 22, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-31525: A vulnerability was found in net/http of the Go standard library when parsing very large HTTP header values, causing a crash and subsequent denial of service. This vulnerability affects both clients and servers written in Go, however servers are only vulnerable if the default 1 MB value for MaxHeaderBytes is increased. 1958341: CVE-2021-31525 golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2 golang 0:1.15.12-1.amzn2.0.1
Amazon Linux · 2 golang-bin 0:1.15.12-1.amzn2.0.1
Amazon Linux · 2 golang-docs 0:1.15.12-1.amzn2.0.1
Amazon Linux · 2 golang-misc 0:1.15.12-1.amzn2.0.1
Amazon Linux · 2 golang-race 0:1.15.12-1.amzn2.0.1
Amazon Linux · 2 golang-src 0:1.15.12-1.amzn2.0.1
Amazon Linux · 2 golang-tests 0:1.15.12-1.amzn2.0.1

Vulnerabilities 1

  • Medium 5.9
    CVE-2021-31525

    golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion

    net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

    go stdlib k3d golang-1.16 Debian Ubuntu Alpine Wolfi Go

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-31525.html