Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41715: No description is available for this CVE. CVE-2022-2879: Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | golang | 0:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-bin | 0:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-docs | 0:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-misc | 0:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-race | 0:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-shared | 0:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-src | 0:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-tests | 0:1.18.8-1.amzn2.0.1 |
Vulnerabilities 2
-
Unscored —
Unbounded memory consumption when reading headers in archive/tar
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of …
-
Unscored —
Memory exhaustion when compiling regular expressions in regexp/syntax
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…