ALAS2023-2023-312

On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers. (CVE-2023-29403)

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value. (CVE-2023-29406)

aarch64:
    containerd-stress-debuginfo-1.7.2-1.amzn2023.0.2.aarch64
    containerd-stress-1.7.2-1.amzn2023.0.2.aarch64
    containerd-debuginfo-1.7.2-1.amzn2023.0.2.aarch64
    containerd-1.7.2-1.amzn2023.0.2.aarch64
    containerd-debugsource-1.7.2-1.amzn2023.0.2.aarch64

src:
    containerd-1.7.2-1.amzn2023.0.2.src

x86_64:
    containerd-debuginfo-1.7.2-1.amzn2023.0.2.x86_64
    containerd-stress-1.7.2-1.amzn2023.0.2.x86_64
    containerd-stress-debuginfo-1.7.2-1.amzn2023.0.2.x86_64
    containerd-1.7.2-1.amzn2023.0.2.x86_64
    containerd-debugsource-1.7.2-1.amzn2023.0.2.x86_64