Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-28327: An integer overflow flaw was found in Golang's crypto/elliptic library. This flaw allows an attacker to use a crafted scaler input longer than 32 bytes, causing P256().ScalarMult or P256().ScalarBaseMult to panic, leading to a loss of availability. CVE-2022-24675: A buffer overflow flaw was found in Golang's library encoding/pem. This flaw allows an attacker to use a large PEM input (more than 5 MB) ), causing a stack overflow in Decode, which leads to a loss of availability. CVE-2020-29652: A null pointer dereference vulnerability was found in golang. When using the library's ssh server without specifying an option for GSSAPIWithMICConfig, it is possible for an attacker to craft an ssh client connection using the authentication method and cause the server to panic resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | golang | 0:1.18.3-1.amzn2 |
| Amazon Linux · 2 | golang-bin | 0:1.18.3-1.amzn2 |
| Amazon Linux · 2 | golang-docs | 0:1.18.3-1.amzn2 |
| Amazon Linux · 2 | golang-misc | 0:1.18.3-1.amzn2 |
| Amazon Linux · 2 | golang-race | 0:1.18.3-1.amzn2 |
| Amazon Linux · 2 | golang-shared | 0:1.18.3-1.amzn2 |
| Amazon Linux · 2 | golang-src | 0:1.18.3-1.amzn2 |
| Amazon Linux · 2 | golang-tests | 0:1.18.3-1.amzn2 |
Vulnerabilities 3
-
High 7.5
golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability
A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.
-
Unscored —CVE-2022-24675 Public exploit
Stack overflow from a large amount of PEM data in encoding/pem
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.
-
Unscored —
Panic due to large inputs affecting P-256 curves in crypto/elliptic
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.