Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-31394: Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | aws-nitro-enclaves-cli | 0:1.2.2-0.amzn2023 |
| Amazon Linux · 2023 | aws-nitro-enclaves-cli-devel | 0:1.2.2-0.amzn2023 |
| Amazon Linux · 2023 | aws-nitro-enclaves-cli-integration-tests | 0:1.2.2-0.amzn2023 |
Vulnerabilities 1
-
High 7.5
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-31394.html