Skip to content
OpenAdvisories
High ALAS2-2024-2705 3 CVEs

Important: libsoup security update (Amazon Linux 2)

Published Dec 5, 2024 · Updated Dec 19, 2024

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-52532: GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients. CVE-2024-52531: GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. Input received over the network cannot trigger this. CVE-2024-52530: GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 libsoup 0:2.56.0-6.amzn2.0.1
Amazon Linux · 2 libsoup-debuginfo 0:2.56.0-6.amzn2.0.1
Amazon Linux · 2 libsoup-devel 0:2.56.0-6.amzn2.0.1

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-52530.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-52531.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-52532.html