Lucene search

AmazonALAS2-2021-1578

HistoryJan 05, 2021 - 11:34 p.m.

Medium: golang

2021-01-0523:34:00

alas.aws.amazon.com

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.016 Low

EPSS

Percentile

87.3%

JSON

Issue Overview:

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. (CVE-2020-28362)

Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. (CVE-2020-28366)

Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. (CVE-2020-28367)

Affected Packages:

golang

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update golang to update your system.

New Packages:

aarch64:  
    golang-1.15.5-1.amzn2.0.2.aarch64  
    golang-bin-1.15.5-1.amzn2.0.2.aarch64  
  
noarch:  
    golang-docs-1.15.5-1.amzn2.0.2.noarch  
    golang-misc-1.15.5-1.amzn2.0.2.noarch  
    golang-tests-1.15.5-1.amzn2.0.2.noarch  
    golang-src-1.15.5-1.amzn2.0.2.noarch  
  
src:  
    golang-1.15.5-1.amzn2.0.2.src  
  
x86_64:  
    golang-1.15.5-1.amzn2.0.2.x86_64  
    golang-bin-1.15.5-1.amzn2.0.2.x86_64  
    golang-race-1.15.5-1.amzn2.0.2.x86_64

Additional References

Red Hat: CVE-2020-28362, CVE-2020-28366, CVE-2020-28367

Mitre: CVE-2020-28362, CVE-2020-28366, CVE-2020-28367

OSVersionArchitecturePackageVersionFilename
Amazon Linux2aarch64golang< 1.15.5-1.amzn2.0.2golang-1.15.5-1.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64golang-bin< 1.15.5-1.amzn2.0.2golang-bin-1.15.5-1.amzn2.0.2.aarch64.rpm
Amazon Linux2noarchgolang-docs< 1.15.5-1.amzn2.0.2golang-docs-1.15.5-1.amzn2.0.2.noarch.rpm
Amazon Linux2noarchgolang-misc< 1.15.5-1.amzn2.0.2golang-misc-1.15.5-1.amzn2.0.2.noarch.rpm
Amazon Linux2noarchgolang-tests< 1.15.5-1.amzn2.0.2golang-tests-1.15.5-1.amzn2.0.2.noarch.rpm
Amazon Linux2noarchgolang-src< 1.15.5-1.amzn2.0.2golang-src-1.15.5-1.amzn2.0.2.noarch.rpm
Amazon Linux2x86_64golang< 1.15.5-1.amzn2.0.2golang-1.15.5-1.amzn2.0.2.x86_64.rpm
Amazon Linux2x86_64golang-bin< 1.15.5-1.amzn2.0.2golang-bin-1.15.5-1.amzn2.0.2.x86_64.rpm
Amazon Linux2x86_64golang-race< 1.15.5-1.amzn2.0.2golang-race-1.15.5-1.amzn2.0.2.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	2	aarch64	golang	< 1.15.5-1.amzn2.0.2	golang-1.15.5-1.amzn2.0.2.aarch64.rpm
Amazon Linux	2	aarch64	golang-bin	< 1.15.5-1.amzn2.0.2	golang-bin-1.15.5-1.amzn2.0.2.aarch64.rpm
Amazon Linux	2	noarch	golang-docs	< 1.15.5-1.amzn2.0.2	golang-docs-1.15.5-1.amzn2.0.2.noarch.rpm
Amazon Linux	2	noarch	golang-misc	< 1.15.5-1.amzn2.0.2	golang-misc-1.15.5-1.amzn2.0.2.noarch.rpm
Amazon Linux	2	noarch	golang-tests	< 1.15.5-1.amzn2.0.2	golang-tests-1.15.5-1.amzn2.0.2.noarch.rpm
Amazon Linux	2	noarch	golang-src	< 1.15.5-1.amzn2.0.2	golang-src-1.15.5-1.amzn2.0.2.noarch.rpm
Amazon Linux	2	x86_64	golang	< 1.15.5-1.amzn2.0.2	golang-1.15.5-1.amzn2.0.2.x86_64.rpm
Amazon Linux	2	x86_64	golang-bin	< 1.15.5-1.amzn2.0.2	golang-bin-1.15.5-1.amzn2.0.2.x86_64.rpm
Amazon Linux	2	x86_64	golang-race	< 1.15.5-1.amzn2.0.2	golang-race-1.15.5-1.amzn2.0.2.x86_64.rpm