ALAS2023-2023-142

Amazon Linux 2023 Security Advisory: ALAS-2023-142
Advisory Release Date: 2023-03-20 18:27 Pacific
Advisory Updated Date: 2023-03-23 01:26 Pacific
Severity: Important
Issue Overview:

http2/hpack: avoid quadratic complexity in hpack decoding (CVE-2022-41723)


Affected Packages:

golang


Issue Correction:
Run dnf update --releasever=2023.0.20230322 golang to update your system.

New Packages:
aarch64:
    golang-1.19.6-1.amzn2023.0.1.aarch64
    golang-bin-1.19.6-1.amzn2023.0.1.aarch64
    golang-shared-1.19.6-1.amzn2023.0.1.aarch64

noarch:
    golang-docs-1.19.6-1.amzn2023.0.1.noarch
    golang-misc-1.19.6-1.amzn2023.0.1.noarch
    golang-src-1.19.6-1.amzn2023.0.1.noarch
    golang-tests-1.19.6-1.amzn2023.0.1.noarch

src:
    golang-1.19.6-1.amzn2023.0.1.src

x86_64:
    golang-1.19.6-1.amzn2023.0.1.x86_64
    golang-race-1.19.6-1.amzn2023.0.1.x86_64
    golang-bin-1.19.6-1.amzn2023.0.1.x86_64
    golang-shared-1.19.6-1.amzn2023.0.1.x86_64

Additional References

Red Hat: CVE-2022-41723

Mitre: CVE-2022-41723