Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3978: Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. CVE-2023-39325: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | nerdctl | 0:1.6.2-1.amzn2.0.2 |
| Amazon Linux · 2 | nerdctl-debuginfo | 0:1.6.2-1.amzn2.0.2 |
Vulnerabilities 2
-
High 7.5CVE-2023-39325 Public exploit
HTTP/2 rapid reset can cause excessive work in net/http
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…
-
Medium 6.1
Improper rendering of text nodes in golang.org/x/net/html
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.