Amazon Linux AMI update for golang-github-cpuguy83-md2man



Risk Medium
Patch available YES
Number of vulnerabilities 15
CVE-ID CVE-2022-1705
CVE-2022-1962
CVE-2022-24675
CVE-2022-27191
CVE-2022-28131
CVE-2022-28327
CVE-2022-29526
CVE-2022-30629
CVE-2022-30630
CVE-2022-30631
CVE-2022-30632
CVE-2022-30633
CVE-2022-30635
CVE-2022-32148
CVE-2022-1996
CWE-ID CWE-444
CWE-400
CWE-120
CWE-327
CWE-190
CWE-264
CWE-330
CWE-254
CWE-942
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Amazon Linux AMI
Operating systems & Components / Operating system

golang-github-cpuguy83-md2man
Operating systems & Components / Operating system package or component

Vendor Amazon Web Services

Security Bulletin

This security bulletin contains information about 15 vulnerabilities.

1) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU66064

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-1705

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of Transfer-Encoding headers in HTTP/1 responses. A remote attacker can send a specially crafted HTTP/1 response to the client and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Mitigation

Update the affected packages:

aarch64:
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.aarch64

noarch:
    compat-golang-github-cpuguy83-md2man-2-devel-2.0.2-22.amzn2023.0.2.noarch
    golang-github-cpuguy83-md2man-devel-2.0.2-22.amzn2023.0.2.noarch

src:
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.src

x86_64:
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang-github-cpuguy83-md2man: before 2.0.2-22

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-047.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource exhaustion

EUVDB-ID: #VU66065

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-1962

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in go/parser. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.aarch64

noarch:
    compat-golang-github-cpuguy83-md2man-2-devel-2.0.2-22.amzn2023.0.2.noarch
    golang-github-cpuguy83-md2man-devel-2.0.2-22.amzn2023.0.2.noarch

src:
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.src

x86_64:
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang-github-cpuguy83-md2man: before 2.0.2-22

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-047.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

EUVDB-ID: #VU64266

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-24675

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in the Golang's library encoding/pem. A remote attacker can send to victim a large (more than 5 MB) PEM input to cause a stack overflow in Decode and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.aarch64

noarch:
    compat-golang-github-cpuguy83-md2man-2-devel-2.0.2-22.amzn2023.0.2.noarch
    golang-github-cpuguy83-md2man-devel-2.0.2-22.amzn2023.0.2.noarch

src:
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.src

x86_64:
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang-github-cpuguy83-md2man: before 2.0.2-22

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-047.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use of a broken or risky cryptographic algorithm

EUVDB-ID: #VU62039

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27191

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in golang.org/x/crypto/ssh before 0.0.0-20220314234659-1baeb1ce4c0b, as used in Go programming language. A remote attacker can crash a server in certain circumstances involving AddHostKey.

Mitigation

Update the affected packages:

aarch64:
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.aarch64

noarch:
    compat-golang-github-cpuguy83-md2man-2-devel-2.0.2-22.amzn2023.0.2.noarch
    golang-github-cpuguy83-md2man-devel-2.0.2-22.amzn2023.0.2.noarch

src:
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.src

x86_64:
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang-github-cpuguy83-md2man: before 2.0.2-22

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-047.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource exhaustion

EUVDB-ID: #VU66069

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-28131

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when calling Decoder.Skip when parsing a deeply nested XML document. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.aarch64

noarch:
    compat-golang-github-cpuguy83-md2man-2-devel-2.0.2-22.amzn2023.0.2.noarch
    golang-github-cpuguy83-md2man-devel-2.0.2-22.amzn2023.0.2.noarch

src:
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.src

x86_64:
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang-github-cpuguy83-md2man: before 2.0.2-22

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-047.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Integer overflow

EUVDB-ID: #VU64269

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-28327

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to integer overflow in the Golang's library crypto/elliptic. A remote attacker can send a specially crafted scalar input longer than 32 bytes to cause P256().ScalarMult or P256().ScalarBaseMult to panic and perform a denial of service attack.

Mitigation

Update the affected packages:

aarch64:
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.aarch64

noarch:
    compat-golang-github-cpuguy83-md2man-2-devel-2.0.2-22.amzn2023.0.2.noarch
    golang-github-cpuguy83-md2man-devel-2.0.2-22.amzn2023.0.2.noarch

src:
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.src

x86_64:
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang-github-cpuguy83-md2man: before 2.0.2-22

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-047.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU63173

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29526

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to the Faccessat function can incorrectly report that a file is accessible, when called with a non-zero flags parameter. An attacker can bypass implemented security restrictions.

Mitigation

Update the affected packages:

aarch64:
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.aarch64

noarch:
    compat-golang-github-cpuguy83-md2man-2-devel-2.0.2-22.amzn2023.0.2.noarch
    golang-github-cpuguy83-md2man-devel-2.0.2-22.amzn2023.0.2.noarch

src:
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.src

x86_64:
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang-github-cpuguy83-md2man: before 2.0.2-22

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-047.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use of insufficiently random values

EUVDB-ID: #VU66122

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30629

CWE-ID: CWE-330 - Use of Insufficiently Random Values

Exploit availability: No

Description

The vulnerability allows a remote attacker gain access to sensitive information.

The vulnerability exists in crypto/tls implementation when generating TLS tickets age. The newSessionTicketMsgTLS13.ageAdd is always set to "0" instead of a random value.

Mitigation

Update the affected packages:

aarch64:
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.aarch64

noarch:
    compat-golang-github-cpuguy83-md2man-2-devel-2.0.2-22.amzn2023.0.2.noarch
    golang-github-cpuguy83-md2man-devel-2.0.2-22.amzn2023.0.2.noarch

src:
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.src

x86_64:
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang-github-cpuguy83-md2man: before 2.0.2-22

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-047.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Resource exhaustion

EUVDB-ID: #VU66063

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30630

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when calling Glob on a path that contains a large number of path separators. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.aarch64

noarch:
    compat-golang-github-cpuguy83-md2man-2-devel-2.0.2-22.amzn2023.0.2.noarch
    golang-github-cpuguy83-md2man-devel-2.0.2-22.amzn2023.0.2.noarch

src:
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.src

x86_64:
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang-github-cpuguy83-md2man: before 2.0.2-22

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-047.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Resource exhaustion

EUVDB-ID: #VU66062

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30631

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in Reader.Read method when handling an archive that contains a large number of concatenated 0-length compressed files. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.aarch64

noarch:
    compat-golang-github-cpuguy83-md2man-2-devel-2.0.2-22.amzn2023.0.2.noarch
    golang-github-cpuguy83-md2man-devel-2.0.2-22.amzn2023.0.2.noarch

src:
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.src

x86_64:
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang-github-cpuguy83-md2man: before 2.0.2-22

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-047.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Resource exhaustion

EUVDB-ID: #VU66067

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30632

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when calling Glob on a path that contains a large number of path separators. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.aarch64

noarch:
    compat-golang-github-cpuguy83-md2man-2-devel-2.0.2-22.amzn2023.0.2.noarch
    golang-github-cpuguy83-md2man-devel-2.0.2-22.amzn2023.0.2.noarch

src:
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.src

x86_64:
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang-github-cpuguy83-md2man: before 2.0.2-22

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-047.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Resource exhaustion

EUVDB-ID: #VU66070

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30633

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when calling Unmarshal on a XML document into a Go struct which has a nested field that uses the any field tag. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.aarch64

noarch:
    compat-golang-github-cpuguy83-md2man-2-devel-2.0.2-22.amzn2023.0.2.noarch
    golang-github-cpuguy83-md2man-devel-2.0.2-22.amzn2023.0.2.noarch

src:
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.src

x86_64:
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang-github-cpuguy83-md2man: before 2.0.2-22

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-047.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Resource exhaustion

EUVDB-ID: #VU66068

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30635

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when calling Decoder.Decode on a message which contains deeply nested structures. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.aarch64

noarch:
    compat-golang-github-cpuguy83-md2man-2-devel-2.0.2-22.amzn2023.0.2.noarch
    golang-github-cpuguy83-md2man-devel-2.0.2-22.amzn2023.0.2.noarch

src:
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.src

x86_64:
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang-github-cpuguy83-md2man: before 2.0.2-22

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-047.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Security features bypass

EUVDB-ID: #VU66066

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-32148

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to unexpected behavior of httputil.ReverseProxy.ServeHTTP. When the method is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation.

Mitigation

Update the affected packages:

aarch64:
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.aarch64

noarch:
    compat-golang-github-cpuguy83-md2man-2-devel-2.0.2-22.amzn2023.0.2.noarch
    golang-github-cpuguy83-md2man-devel-2.0.2-22.amzn2023.0.2.noarch

src:
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.src

x86_64:
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang-github-cpuguy83-md2man: before 2.0.2-22

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-047.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Overly permissive cross-domain whitelist

EUVDB-ID: #VU66447

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-1996

CWE-ID: CWE-942 - Overly Permissive Cross-domain Whitelist

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass the CORS protection mechanism.

The vulnerability exists due to incorrect processing of the "Origin" HTTP header that is supplied within HTTP request. A remote attacker can supply arbitrary value via the "Origin" HTTP header, bypass implemented CORS protection mechanism and perform cross-site scripting attacks against the vulnerable application.

Mitigation

Update the affected packages:

aarch64:
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.aarch64
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.aarch64

noarch:
    compat-golang-github-cpuguy83-md2man-2-devel-2.0.2-22.amzn2023.0.2.noarch
    golang-github-cpuguy83-md2man-devel-2.0.2-22.amzn2023.0.2.noarch

src:
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.src

x86_64:
    golang-github-cpuguy83-md2man-debugsource-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-2.0.2-22.amzn2023.0.2.x86_64
    golang-github-cpuguy83-md2man-debuginfo-2.0.2-22.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

golang-github-cpuguy83-md2man: before 2.0.2-22

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-047.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###