Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41723: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41722: The Go project has described this issue as follows: "On Windows, the filepath.Clean function could transform an invalid path such as a/../c:/b into the valid path c:\b. This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. The filepath.Clean function will now transform this path into the relative (but still invalid) path .\c:\b." CVE-2022-30634: Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes. CVE-2022-30580: Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset. CVE-2022-2880: Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparseable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | golang | 0:1.18.9-1.amzn2.0.2 |
| Amazon Linux · 2 | golang-bin | 0:1.18.9-1.amzn2.0.2 |
| Amazon Linux · 2 | golang-docs | 0:1.18.9-1.amzn2.0.2 |
| Amazon Linux · 2 | golang-misc | 0:1.18.9-1.amzn2.0.2 |
| Amazon Linux · 2 | golang-race | 0:1.18.9-1.amzn2.0.2 |
| Amazon Linux · 2 | golang-shared | 0:1.18.9-1.amzn2.0.2 |
| Amazon Linux · 2 | golang-src | 0:1.18.9-1.amzn2.0.2 |
| Amazon Linux · 2 | golang-tests | 0:1.18.9-1.amzn2.0.2 |
Vulnerabilities 5
-
High 7.8
Empty Cmd.Path can trigger unintended binary in os/exec on Windows
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.
-
High 7.5
Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
-
Unscored —
Incorrect sanitization of forwarded query parameters in net/http/httputil
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…
-
Unscored —
Indefinite hang with large buffers on Windows in crypto/rand
Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.
-
Unscored —
Path traversal on Windows in path/filepath
A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute pa…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-2880.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-30580.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-30634.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-41722.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-41723.html