SB202502194444 - Amazon Linux AMI update for ecs-service-connect-agent
Published: February 19, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Reliance on undefined behavior (CVE-ID: CVE-2023-30624)
The vulnerability allows a remote attacker to influence application's behavior.
The vulnerability exists due to LLVM-level undefined behavior when managing per-instance state. A remote attacker can leverage this vulnerability to cause runtime-level issues when compiled with LLVM 16, which can influence application behavior.
2) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CVE-ID: CVE-2023-31124)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an error when cross-compiling c-ares and using the autotools build system. As a result, the CARES_RANDOM_FILE is not be set, which results in usage of a rand() function as a fallback, leading to weak entropy.
3) Buffer Underwrite ('Buffer Underflow') (CVE-ID: CVE-2023-31130)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a buffer underflow when using certain IPv6 addresses, such as 0::00:00:00/2". A local privileged user can trigger a boundary error and crash the service.
4) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CVE-ID: CVE-2023-31147)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to usage of a rand() function in case /dev/urandom or RtlGenRandom() are unavailable. A remote attacker can perform spoofing attack.
5) Input validation error (CVE-ID: CVE-2023-32067)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
6) Input validation error (CVE-ID: CVE-2023-32067)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when processing DNS responses. A remote attacker can send a specially crafted DNS response to the application and perform a denial of service (DoS) attack.
7) Improper Encoding or Escaping of Output (CVE-ID: CVE-2023-35941)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to improper encoding or escaping of output. A remote attacker can construct credentials with permanent validity.
8) Use-after-free (CVE-ID: CVE-2023-35942)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the gRPC access logger extension. A remote user can perform a denial of service (DoS) attack.
9) Use-after-free (CVE-ID: CVE-2023-35943)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the HTTP CORS filter. A remote user can perform a denial of service (DoS) attack.
10) Input validation error (CVE-ID: CVE-2023-35944)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to incorrect handling of requests and responses with mixed case schemes. A remote attacker can pass specially crafted input to the application and bypass some requests with mixed schemes.
Remediation
Install update from vendor's website.