Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-27664: In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | golang | 0:1.18.6-1.amzn2 |
| Amazon Linux · 2 | golang-bin | 0:1.18.6-1.amzn2 |
| Amazon Linux · 2 | golang-docs | 0:1.18.6-1.amzn2 |
| Amazon Linux · 2 | golang-misc | 0:1.18.6-1.amzn2 |
| Amazon Linux · 2 | golang-race | 0:1.18.6-1.amzn2 |
| Amazon Linux · 2 | golang-shared | 0:1.18.6-1.amzn2 |
| Amazon Linux · 2 | golang-src | 0:1.18.6-1.amzn2 |
| Amazon Linux · 2 | golang-tests | 0:1.18.6-1.amzn2 |
Vulnerabilities 1
-
High 7.5
golang.org/x/net/http2 Denial of Service vulnerability
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-27664.html