跳转到帖子

Amazon Linux 2023: CVE-2024-24786: Medium priority package update for amazon-cloudwatch-agent (Multiple Advisories)

recommended_posts

发布于
  • Members

Amazon Linux 2023: CVE-2024-24786: Medium priority package update for amazon-cloudwatch-agent (Multiple Advisories)

Severity
5
CVSS
(AV:N/AC:H/Au:N/C:N/I:N/A:C)
Published
03/05/2024
Created
02/14/2025
Added
02/14/2025
Modified
02/14/2025

Description

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set. A flaw was found in Golang's protobuf module, where the unmarshal function can enter an infinite loop when processing certain invalid inputs. This issue occurs during unmarshaling into a message that includes a google.protobuf.Any or when the UnmarshalOptions.DiscardUnknown option is enabled. This flaw allows an attacker to craft malicious input tailored to trigger the identified flaw in the unmarshal function. By providing carefully constructed invalid inputs, they could potentially cause the function to enter an infinite loop, resulting in a denial of service condition or other unintended behaviors in the affected system.

Solution(s)

  • amazon-linux-2023-upgrade-amazon-cloudwatch-agent
  • amazon-linux-2023-upgrade-containerd
  • amazon-linux-2023-upgrade-containerd-debuginfo
  • amazon-linux-2023-upgrade-containerd-debugsource
  • amazon-linux-2023-upgrade-containerd-stress
  • amazon-linux-2023-upgrade-containerd-stress-debuginfo
  • amazon-linux-2023-upgrade-docker
  • amazon-linux-2023-upgrade-docker-debuginfo
  • amazon-linux-2023-upgrade-docker-debugsource
  • amazon-linux-2023-upgrade-nerdctl

References

  • https://attackerkb.com/topics/cve-2024-24786
  • CVE - 2024-24786
  • https://alas.aws.amazon.com/AL2023/ALAS-2024-625.html
  • https://alas.aws.amazon.com/AL2023/ALAS-2024-674.html
  • https://alas.aws.amazon.com/AL2023/ALAS-2024-697.html
  • https://alas.aws.amazon.com/AL2023/ALAS-2024-700.html
  • 查看数 706
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。
注意:你的帖子需要版主批准后才能看到。

游客
回帖…