Lucene search

K
amazonAmazonALAS-2024-2545
HistoryMay 09, 2024 - 7:16 p.m.

Important: golang

2024-05-0919:16:00
alas.aws.amazon.com
4
golang
update
security vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.01 Low

EPSS

Percentile

83.4%

Issue Overview:

2024-05-23: CVE-2019-16276 was added to this advisory.

It was discovered that net/http (through net/textproto) in golang does not correctly interpret HTTP requests where an HTTP header contains spaces before the colon. This could be abused by an attacker to smuggle HTTP requests when a proxy or a firewall is placed behind a server implemented in Go or to filter bypasses depending on the specific network configuration. (CVE-2019-16276)

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates. (CVE-2019-17596)

Affected Packages:

golang

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update golang to update your system.

New Packages:

aarch64:  
    golang-1.13.4-1.amzn2.0.1.aarch64  
    golang-bin-1.13.4-1.amzn2.0.1.aarch64  
  
noarch:  
    golang-docs-1.13.4-1.amzn2.0.1.noarch  
    golang-misc-1.13.4-1.amzn2.0.1.noarch  
    golang-tests-1.13.4-1.amzn2.0.1.noarch  
    golang-src-1.13.4-1.amzn2.0.1.noarch  
  
src:  
    golang-1.13.4-1.amzn2.0.1.src  
  
x86_64:  
    golang-1.13.4-1.amzn2.0.1.x86_64  
    golang-bin-1.13.4-1.amzn2.0.1.x86_64  
    golang-race-1.13.4-1.amzn2.0.1.x86_64  

Additional References

Red Hat: CVE-2019-16276, CVE-2019-17596

Mitre: CVE-2019-16276, CVE-2019-17596

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.01 Low

EPSS

Percentile

83.4%