Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39325: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | oci-add-hooks | 0:0-0.1.20200504git268e3bb.amzn2023.0.2 |
| Amazon Linux · 2023 | oci-add-hooks-debuginfo | 0:0-0.1.20200504git268e3bb.amzn2023.0.2 |
| Amazon Linux · 2023 | oci-add-hooks-debugsource | 0:0-0.1.20200504git268e3bb.amzn2023.0.2 |
Vulnerabilities 1
-
High 7.5CVE-2023-39325 Public exploit
HTTP/2 rapid reset can cause excessive work in net/http
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-39325.html