Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-7250: It is possible for a malicious or malfunctioning client to send less than the expected amount of data to the server. If this happens, the server will hang indefinitely waiting for the remainder (or until the connection gets closed). Because iperf3 is deliberately designed to service only one client connection at a time, this will prevent other connections to the iperf3 server. Avoid running iperf3 with root privileges to minimize impact. Update iperf3 to a version containing the fix (i.e. iperf-3.15 or later).
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | iperf3 | 0:3.1.7-2.amzn2.0.4 |
| Amazon Linux · 2 | iperf3-debuginfo | 0:3.1.7-2.amzn2.0.4 |
| Amazon Linux · 2 | iperf3-devel | 0:3.1.7-2.amzn2.0.4 |
Vulnerabilities 1
-
Medium 5.3
Iperf3: possible denial of service
A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-7250.html