Amazon Linux 2023 Security Advisory: ALAS-2024-689
Advisory Release Date: 2024-08-01 04:06 Pacific
Advisory Updated Date: 2024-08-06 15:00 Pacific
Severity:
Medium
Issue Overview:
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. (CVE-2024-36387)
Affected Packages:
mod_http2
Issue Correction:
Run dnf update mod_http2 --releasever 2023.5.20240805 to update your system.
New Packages:
aarch64:
mod_http2-debugsource-2.0.27-1.amzn2023.0.3.aarch64
mod_http2-2.0.27-1.amzn2023.0.3.aarch64
mod_http2-debuginfo-2.0.27-1.amzn2023.0.3.aarch64
src:
mod_http2-2.0.27-1.amzn2023.0.3.src
x86_64:
mod_http2-debuginfo-2.0.27-1.amzn2023.0.3.x86_64
mod_http2-debugsource-2.0.27-1.amzn2023.0.3.x86_64
mod_http2-2.0.27-1.amzn2023.0.3.x86_64