Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALAS-2023-1866

Related Vulnerabilities: CVE-2021-43565   CVE-2022-41723   CVE-2023-24538  

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server. (CVE-2021-43565) http2/hpack: avoid quadratic complexity in hpack decoding (CVE-2022-41723) Templates did not properly consider backticks (`) as Javascript string delimiters, and as such didnot escape them as expected. Backticks are used, since ES6, for JS template literals. If a templatecontained a Go template action within a Javascript template literal, the contents of the action couldbe used to terminate the literal, injecting arbitrary Javascript code into the Go template. (CVE-2023-24538)

Source

ALAS-2023-1866

Amazon Linux 1 Security Advisory: ALAS-2023-1866
Advisory Release Date: 2023-10-12 15:48 Pacific
Advisory Updated Date: 2023-10-24 21:37 Pacific
Severity: Important
Issue Overview:

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server. (CVE-2021-43565)

http2/hpack: avoid quadratic complexity in hpack decoding (CVE-2022-41723)

Templates did not properly consider backticks (`) as Javascript string delimiters, and as such did
not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template
contained a Go template action within a Javascript template literal, the contents of the action could
be used to terminate the literal, injecting arbitrary Javascript code into the Go template. (CVE-2023-24538)


Affected Packages:

amazon-ssm-agent


Issue Correction:
Run yum update amazon-ssm-agent to update your system.

New Packages:
src:
    amazon-ssm-agent-3.2.1705.0-1.amzn1.src

x86_64:
    amazon-ssm-agent-debuginfo-3.2.1705.0-1.amzn1.x86_64
    amazon-ssm-agent-3.2.1705.0-1.amzn1.x86_64

Additional References

Red Hat: CVE-2021-43565, CVE-2022-41723, CVE-2023-24538

Mitre: CVE-2021-43565, CVE-2022-41723, CVE-2023-24538

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started