Skip to content
OpenAdvisories
Medium ALAS2-2024-2579 1 CVE

Moderate: iperf3 security update (Amazon Linux 2)

Published Jun 19, 2024 · Updated Jun 24, 2024

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-7250: It is possible for a malicious or malfunctioning client to send less than the expected amount of data to the server. If this happens, the server will hang indefinitely waiting for the remainder (or until the connection gets closed). Because iperf3 is deliberately designed to service only one client connection at a time, this will prevent other connections to the iperf3 server. Avoid running iperf3 with root privileges to minimize impact. Update iperf3 to a version containing the fix (i.e. iperf-3.15 or later).

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 iperf3 0:3.1.7-2.amzn2.0.4
Amazon Linux · 2 iperf3-debuginfo 0:3.1.7-2.amzn2.0.4
Amazon Linux · 2 iperf3-devel 0:3.1.7-2.amzn2.0.4

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-7250.html