Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALAS2-2023-2238

Related Vulnerabilities: CVE-2021-43565   CVE-2022-27191   CVE-2022-27664   CVE-2022-41723  

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server. (CVE-2021-43565) A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to fail authentification with RSA keys to servers that reject signature algorithms based on SHA-2, enabling an attacker to crash the server, resulting in a loss of availability. (CVE-2022-27191) In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664) http2/hpack: avoid quadratic complexity in hpack decoding (CVE-2022-41723)

Source

ALAS2-2023-2238

Amazon Linux 2 Security Advisory: ALAS-2023-2238
Advisory Release Date: 2023-08-31 22:30 Pacific
Advisory Updated Date: 2023-09-07 18:49 Pacific
Severity: Important
Issue Overview:

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server. (CVE-2021-43565)

A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to fail authentification with RSA keys to servers that reject signature algorithms based on SHA-2, enabling an attacker to crash the server, resulting in a loss of availability. (CVE-2022-27191)

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

http2/hpack: avoid quadratic complexity in hpack decoding (CVE-2022-41723)


Affected Packages:

amazon-ssm-agent


Issue Correction:
Run yum update amazon-ssm-agent to update your system.

New Packages:
aarch64:
    amazon-ssm-agent-3.2.1377.0-1.amzn2.aarch64
    amazon-ssm-agent-debuginfo-3.2.1377.0-1.amzn2.aarch64

src:
    amazon-ssm-agent-3.2.1377.0-1.amzn2.src

x86_64:
    amazon-ssm-agent-3.2.1377.0-1.amzn2.x86_64
    amazon-ssm-agent-debuginfo-3.2.1377.0-1.amzn2.x86_64

Additional References

Red Hat: CVE-2021-43565, CVE-2022-27191, CVE-2022-27664, CVE-2022-41723

Mitre: CVE-2021-43565, CVE-2022-27191, CVE-2022-27664, CVE-2022-41723

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started