Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-34558: A flaw was found in golang. A panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists (or can be issued), or the client is configured with Config.InsecureSkipVerify. Clients that disable all TLS_RSA cipher suites (that is, TLS 1.0-1.2 cipher suites without ECDHE), as well as TLS 1.3-only clients, are unaffected. 1983596: CVE-2021-34558 golang: crypto/tls: certificate of wrong type is causing TLS client to panic CVE-2021-33196: A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files. 1965503: CVE-2021-33196 golang: archive/zip: Malformed archive may cause panic or memory exhaustion
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | golang | 0:1.15.14-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-bin | 0:1.15.14-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-docs | 0:1.15.14-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-misc | 0:1.15.14-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-race | 0:1.15.14-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-src | 0:1.15.14-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-tests | 0:1.15.14-1.amzn2.0.1 |
Vulnerabilities 2
-
Unscored —
Panic when reading certain archives in archive/zip
In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.
-
Unscored —CVE-2021-34558 Public exploit
Panic on certain certificates in crypto/tls
The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.