Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-27539: The Ruby on Rails advisory describes this vulnerability as follows: Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | pcs | 0:0.9.169-3.amzn2.3.0.2 |
| Amazon Linux · 2 | pcs-debuginfo | 0:0.9.169-3.amzn2.3.0.2 |
| Amazon Linux · 2 | pcs-snmp | 0:0.9.169-3.amzn2.3.0.2 |
Vulnerabilities 1
-
Medium 5.3
Possible Denial of Service Vulnerability in Rack's header parsing
There is a denial of service vulnerability in the header parsing component of Rack.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-27539.html