Amazon Linux 2023 Security Advisory: ALAS-2023-449
Advisory Release Date: 2023-12-06 07:45 Pacific
Advisory Updated Date: 2023-12-14 21:43 Pacific
Severity:
Medium
Issue Overview:
In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the "get" substring. (CVE-2023-46852)
In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n. (CVE-2023-46853)
Affected Packages:
memcached
Issue Correction:
Run dnf update memcached --releasever 2023.3.20231211 to update your system.
New Packages:
aarch64:
memcached-devel-1.6.22-2.amzn2023.0.1.aarch64
memcached-debugsource-1.6.22-2.amzn2023.0.1.aarch64
memcached-debuginfo-1.6.22-2.amzn2023.0.1.aarch64
memcached-selinux-1.6.22-2.amzn2023.0.1.aarch64
memcached-1.6.22-2.amzn2023.0.1.aarch64
src:
memcached-1.6.22-2.amzn2023.0.1.src
x86_64:
memcached-debugsource-1.6.22-2.amzn2023.0.1.x86_64
memcached-devel-1.6.22-2.amzn2023.0.1.x86_64
memcached-debuginfo-1.6.22-2.amzn2023.0.1.x86_64
memcached-selinux-1.6.22-2.amzn2023.0.1.x86_64
memcached-1.6.22-2.amzn2023.0.1.x86_64