跳转到帖子

Amazon Linux 2023: CVE-2024-24790: Medium priority package update for golang (Multiple Advisories)

recommended_posts

发布于
  • Members

Amazon Linux 2023: CVE-2024-24790: Medium priority package update for golang (Multiple Advisories)

Severity
6
CVSS
(AV:L/AC:H/Au:N/C:C/I:C/A:N)
Published
06/04/2024
Created
02/14/2025
Added
02/14/2025
Modified
02/14/2025

Description

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. A flaw was found in the Go language standard library net/netip. The method Is*() (IsPrivate(), IsPublic(), etc) doesn't behave properly when working with IPv6 mapped to IPv4 addresses. The unexpected behavior can lead to integrity and confidentiality issues, specifically when these methods are used to control access to resources or data.

Solution(s)

  • amazon-linux-2023-upgrade-amazon-ecr-credential-helper
  • amazon-linux-2023-upgrade-amazon-ssm-agent
  • amazon-linux-2023-upgrade-containerd
  • amazon-linux-2023-upgrade-containerd-debuginfo
  • amazon-linux-2023-upgrade-containerd-debugsource
  • amazon-linux-2023-upgrade-containerd-stress
  • amazon-linux-2023-upgrade-containerd-stress-debuginfo
  • amazon-linux-2023-upgrade-docker
  • amazon-linux-2023-upgrade-docker-debuginfo
  • amazon-linux-2023-upgrade-docker-debugsource
  • amazon-linux-2023-upgrade-golang
  • amazon-linux-2023-upgrade-golang-bin
  • amazon-linux-2023-upgrade-golang-docs
  • amazon-linux-2023-upgrade-golang-misc
  • amazon-linux-2023-upgrade-golang-shared
  • amazon-linux-2023-upgrade-golang-src
  • amazon-linux-2023-upgrade-golang-tests
  • amazon-linux-2023-upgrade-runc
  • amazon-linux-2023-upgrade-runc-debuginfo
  • amazon-linux-2023-upgrade-runc-debugsource

References

  • https://attackerkb.com/topics/cve-2024-24790
  • CVE - 2024-24790
  • https://alas.aws.amazon.com/AL2023/ALAS-2024-646.html
  • https://alas.aws.amazon.com/AL2023/ALAS-2024-697.html
  • https://alas.aws.amazon.com/AL2023/ALAS-2024-710.html
  • https://alas.aws.amazon.com/AL2023/ALAS-2024-711.html
  • https://alas.aws.amazon.com/AL2023/ALAS-2024-734.html
  • https://alas.aws.amazon.com/AL2023/ALAS-2024-735.html
View more
  • 查看数 700
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。

游客
回帖…