Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-30123: A flaw was found in ruby gem-rack. This flaw allows a malicious actor to craft requests that can cause shell escape sequences to be written to the terminal via rack's `Lint` middleware and `CommonLogger` middleware. This issue can leverage these escape sequences to execute commands in the victim's terminal. CVE-2022-30122: A denial of service flaw was found in ruby-rack. An attacker crafting multipart POST requests can cause Rack's multipart parser to take much longer than expected, leading to a denial of service.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | pcs | 0:0.9.169-3.amzn2.1.2 |
| Amazon Linux · 2 | pcs-debuginfo | 0:0.9.169-3.amzn2.1.2 |
| Amazon Linux · 2 | pcs-snmp | 0:0.9.169-3.amzn2.1.2 |
Vulnerabilities 2
-
Critical 10.0
Possible shell escape sequence injection vulnerability in Rack
A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.
-
High 7.5
Denial of Service Vulnerability in Rack Multipart Parsing
A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.