Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-34158: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion. CVE-2024-34156: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635. CVE-2024-34155: Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | golang | 0:1.22.7-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-bin | 0:1.22.7-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-docs | 0:1.22.7-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-misc | 0:1.22.7-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-shared | 0:1.22.7-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-src | 0:1.22.7-1.amzn2.0.1 |
| Amazon Linux · 2 | golang-tests | 0:1.22.7-1.amzn2.0.1 |
Vulnerabilities 3
-
High 7.5
Stack exhaustion in Decoder.Decode in encoding/gob
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
-
High 7.5
Stack exhaustion in Parse in go/build/constraint
Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.
-
Medium 4.3
Stack exhaustion in all Parse functions in go/parser
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.