Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-39325: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | cri-tools | 0:1.26.1-1.amzn2.0.3 |
| Amazon Linux · 2 | cri-tools-debuginfo | 0:1.26.1-1.amzn2.0.3 |
Vulnerabilities 1
-
High 7.5CVE-2023-39325 Public exploit
HTTP/2 rapid reset can cause excessive work in net/http
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-39325.html