Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-52532: GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients. CVE-2024-52531: GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. Input received over the network cannot trigger this. CVE-2024-52530: GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libsoup | 0:2.56.0-6.amzn2.0.1 |
| Amazon Linux · 2 | libsoup-debuginfo | 0:2.56.0-6.amzn2.0.1 |
| Amazon Linux · 2 | libsoup-devel | 0:2.56.0-6.amzn2.0.1 |
Vulnerabilities 3
-
High 7.5
GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of h…
-
High 7.5
GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebS…
-
Medium 6.5
GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_par…