Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-24294: The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ruby | 0:2.0.0.648-36.amzn2.0.16 |
| Amazon Linux · 2 | ruby-debuginfo | 0:2.0.0.648-36.amzn2.0.16 |
| Amazon Linux · 2 | ruby-devel | 0:2.0.0.648-36.amzn2.0.16 |
| Amazon Linux · 2 | ruby-doc | 0:2.0.0.648-36.amzn2.0.16 |
| Amazon Linux · 2 | ruby-irb | 0:2.0.0.648-36.amzn2.0.16 |
| Amazon Linux · 2 | ruby-libs | 0:2.0.0.648-36.amzn2.0.16 |
| Amazon Linux · 2 | ruby-tcltk | 0:2.0.0.648-36.amzn2.0.16 |
| Amazon Linux · 2 | rubygem-bigdecimal | 0:1.2.0-36.amzn2.0.16 |
| Amazon Linux · 2 | rubygem-io-console | 0:0.4.2-36.amzn2.0.16 |
| Amazon Linux · 2 | rubygem-json | 0:1.7.7-36.amzn2.0.16 |
| Amazon Linux · 2 | rubygem-minitest | 0:4.3.2-36.amzn2.0.16 |
| Amazon Linux · 2 | rubygem-psych | 0:2.0.0-36.amzn2.0.16 |
| Amazon Linux · 2 | rubygem-rake | 0:0.9.6-36.amzn2.0.16 |
| Amazon Linux · 2 | rubygem-rdoc | 0:4.0.0-36.amzn2.0.16 |
| Amazon Linux · 2 | rubygems | 0:2.0.14.1-36.amzn2.0.16 |
| Amazon Linux · 2 | rubygems-devel | 0:2.0.14.1-36.amzn2.0.16 |
Vulnerabilities 1
-
High 7.5
resolv vulnerable to DoS via insufficient DNS domain name length validation
The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-24294.html