Amazon Linux AMI update for golang



Risk High
Patch available YES
Number of vulnerabilities 30
CVE-ID CVE-2021-33196
CVE-2021-38297
CVE-2021-41771
CVE-2021-41772
CVE-2021-44716
CVE-2021-44717
CVE-2022-1705
CVE-2022-1962
CVE-2022-23772
CVE-2022-23773
CVE-2022-23806
CVE-2022-24675
CVE-2022-24921
CVE-2022-27191
CVE-2022-27664
CVE-2022-28131
CVE-2022-28327
CVE-2022-2879
CVE-2022-29526
CVE-2022-30629
CVE-2022-30630
CVE-2022-30631
CVE-2022-30632
CVE-2022-30633
CVE-2022-30635
CVE-2022-32148
CVE-2022-32189
CVE-2022-32190
CVE-2022-41715
CVE-2022-41716
CWE-ID CWE-400
CWE-119
CWE-20
CWE-444
CWE-863
CWE-252
CWE-120
CWE-185
CWE-327
CWE-190
CWE-399
CWE-264
CWE-330
CWE-254
CWE-22
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #10 is available.
Vulnerable software
 Amazon Linux AMI
Operating systems & Components / Operating system

golang
Operating systems & Components / Operating system package or component

Vendor Amazon Web Services

Security Bulletin

This security bulletin contains information about 30 vulnerabilities.

1) Resource exhaustion

EUVDB-ID: #VU54521

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-33196

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when parsing archives. A remote attacker can pass a specially crafted .zip file to the application, trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU57579

Risk: High

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2021-38297

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trigger memory corruption via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Buffer overflow

EUVDB-ID: #VU65080

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-41771

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists in debug/macho of the Go standard library when using the debug/macho standard library (stdlib) and malformed binaries are parsed using Open or OpenFat. A remote attacker can send a specially crafted file to perform a denial of service attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU66120

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-41772

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in archive/zip Reader.Open. A remote attacker can pass specially crafted ZIP archive containing an invalid name or an empty filename field to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU58824

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-44716

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource exhaustion

EUVDB-ID: #VU59042

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-44717

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing HTTP/2 requests. A remote attacker can send multiple HTTP/2 requests to the server and exhaust all available memory resources.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU66064

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-1705

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of Transfer-Encoding headers in HTTP/1 responses. A remote attacker can send a specially crafted HTTP/1 response to the client and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Resource exhaustion

EUVDB-ID: #VU66065

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-1962

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in go/parser. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Resource exhaustion

EUVDB-ID: #VU62038

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-23772

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the Rat.SetString(0 function in math/big. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Incorrect authorization

EUVDB-ID: #VU62037

Risk: Low

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2022-23773

CWE-ID: CWE-863 - Incorrect Authorization

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists within cmd/go, which can misinterpret branch names that falsely appear to be version tags. This can lead to  a situation where an attacker can bypass implemented security restrictions and perform restricted actions, e.g. create tags when access was granted to create branches only.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

11) Unchecked Return Value

EUVDB-ID: #VU62036

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-23806

CWE-ID: CWE-252 - Unchecked Return Value

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to unchecked return value within the Curve.IsOnCurve() function in crypto/elliptic. A remote attacker can force the application to incorrectly return true in situations with a big.Int value that is not a valid field element. As a result, an attacker can modify application flow, which can lead to unauthorized data modification or denial of service.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Buffer overflow

EUVDB-ID: #VU64266

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-24675

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in the Golang's library encoding/pem. A remote attacker can send to victim a large (more than 5 MB) PEM input to cause a stack overflow in Decode and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Incorrect Regular Expression

EUVDB-ID: #VU61227

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-24921

CWE-ID: CWE-185 - Incorrect Regular Expression

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in regexp.Compile in Go. A remote attacker can pass specially crafted input to the application and perform regular expression denial of service (ReDoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Use of a broken or risky cryptographic algorithm

EUVDB-ID: #VU62039

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-27191

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in golang.org/x/crypto/ssh before 0.0.0-20220314234659-1baeb1ce4c0b, as used in Go programming language. A remote attacker can crash a server in certain circumstances involving AddHostKey.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Input validation error

EUVDB-ID: #VU67396

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-27664

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Resource exhaustion

EUVDB-ID: #VU66069

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-28131

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when calling Decoder.Skip when parsing a deeply nested XML document. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Integer overflow

EUVDB-ID: #VU64269

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-28327

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to integer overflow in the Golang's library crypto/elliptic. A remote attacker can send a specially crafted scalar input longer than 32 bytes to cause P256().ScalarMult or P256().ScalarBaseMult to panic and perform a denial of service attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Resource management error

EUVDB-ID: #VU68387

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-2879

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to absent limits on the maximum size of file headers within the Reader.Read method in archive/tar. A remote attacker can pass a specially crafted file to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU63173

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-29526

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to the Faccessat function can incorrectly report that a file is accessible, when called with a non-zero flags parameter. An attacker can bypass implemented security restrictions.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Use of insufficiently random values

EUVDB-ID: #VU66122

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-30629

CWE-ID: CWE-330 - Use of Insufficiently Random Values

Exploit availability: No

Description

The vulnerability allows a remote attacker gain access to sensitive information.

The vulnerability exists in crypto/tls implementation when generating TLS tickets age. The newSessionTicketMsgTLS13.ageAdd is always set to "0" instead of a random value.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Resource exhaustion

EUVDB-ID: #VU66063

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-30630

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when calling Glob on a path that contains a large number of path separators. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Resource exhaustion

EUVDB-ID: #VU66062

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-30631

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in Reader.Read method when handling an archive that contains a large number of concatenated 0-length compressed files. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Resource exhaustion

EUVDB-ID: #VU66067

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-30632

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when calling Glob on a path that contains a large number of path separators. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Resource exhaustion

EUVDB-ID: #VU66070

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-30633

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when calling Unmarshal on a XML document into a Go struct which has a nested field that uses the any field tag. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Resource exhaustion

EUVDB-ID: #VU66068

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-30635

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when calling Decoder.Decode on a message which contains deeply nested structures. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Security features bypass

EUVDB-ID: #VU66066

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-32148

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to unexpected behavior of httputil.ReverseProxy.ServeHTTP. When the method is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Input validation error

EUVDB-ID: #VU66121

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-32189

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in
Float.GobDecode. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Path traversal

EUVDB-ID: #VU67556

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-32190

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within JoinPath and URL.JoinPath. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Resource exhaustion

EUVDB-ID: #VU68390

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-41715

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in regexp/syntax when handling regular expressions. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Input validation error

EUVDB-ID: #VU69405

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-41716

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary OS commands on the system.

The vulnerability exists due to insecure processing of unsanitized NUL values in syscall.StartProcess and os/exec.Cmd. A local user on the Windows operating system can set a specially crafted environment variable and execute arbitrary OS commands on the system.

Mitigation

Update the affected packages:

aarch64:
    golang-1.19.3-2.amzn2023.0.2.aarch64
    golang-bin-1.19.3-2.amzn2023.0.2.aarch64
    golang-shared-1.19.3-2.amzn2023.0.2.aarch64

noarch:
    golang-docs-1.19.3-2.amzn2023.0.2.noarch
    golang-misc-1.19.3-2.amzn2023.0.2.noarch
    golang-src-1.19.3-2.amzn2023.0.2.noarch
    golang-tests-1.19.3-2.amzn2023.0.2.noarch

src:
    golang-1.19.3-2.amzn2023.0.2.src

x86_64:
    golang-1.19.3-2.amzn2023.0.2.x86_64
    golang-race-1.19.3-2.amzn2023.0.2.x86_64
    golang-bin-1.19.3-2.amzn2023.0.2.x86_64
    golang-shared-1.19.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang: before 1.19.3-2

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###