Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-46828: In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libtirpc | 0:1.3.3-0.amzn2023 |
| Amazon Linux · 2023 | libtirpc-debuginfo | 0:1.3.3-0.amzn2023 |
| Amazon Linux · 2023 | libtirpc-debugsource | 0:1.3.3-0.amzn2023 |
| Amazon Linux · 2023 | libtirpc-devel | 0:1.3.3-0.amzn2023 |
Vulnerabilities 1
-
High 7.5
In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc becaus…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-46828.html