Skip to content
OpenAdvisories
High ALAS2023-2024-655 1 CVE

Important: ecs-service-connect-agent security update (Amazon Linux 2023)

Published Jul 18, 2024 · Updated Jul 22, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-38525: dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the `nlohmann` JSON library. However, due to the way the JSON library is invoked, it throws an uncaught exception, which results in a crash. This vulnerability has been patched in version 0.2.2.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 ecs-service-connect-agent 0:v1.29.6.0-1.amzn2023

Vulnerabilities 1

  • High 7.5
    CVE-2024-38525

    dd-trace-cpp malformed unicode header values may cause crash

    dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the `nlohmann` JSON library. However, due to the way the JSON library…

    Datadog dd-trace-cpp

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-38525.html