Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24790: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24786: The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | containerd | 0:1.7.20-1.amzn2023.0.1 |
| Amazon Linux · 2023 | containerd-debuginfo | 0:1.7.20-1.amzn2023.0.1 |
| Amazon Linux · 2023 | containerd-debugsource | 0:1.7.20-1.amzn2023.0.1 |
| Amazon Linux · 2023 | containerd-stress | 0:1.7.20-1.amzn2023.0.1 |
| Amazon Linux · 2023 | containerd-stress-debuginfo | 0:1.7.20-1.amzn2023.0.1 |
Vulnerabilities 2
-
Critical 9.8
Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.
-
High 7.5
Infinite loop in JSON unmarshaling in google.golang.org/protobuf
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown opti…