Rapid7 Vulnerability & Exploit Database

Amazon Linux AMI 2: CVE-2023-29406: Security patch for amazon-ssm-agent, cni-plugins, containerd, cri-tools, ecs-init, golang, golist, nerdctl, runc (Multiple Advisories)

Free InsightVM Trial No Credit Card Necessary
2024 Attack Intel Report Latest research by Rapid7 Labs
Back to Search

Amazon Linux AMI 2: CVE-2023-29406: Security patch for amazon-ssm-agent, cni-plugins, containerd, cri-tools, ecs-init, golang, golist, nerdctl, runc (Multiple Advisories)

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
07/11/2023
Created
08/10/2023
Added
08/09/2023
Modified
01/10/2024

Description

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.

Solution(s)

  • amazon-linux-ami-2-upgrade-amazon-ssm-agent
  • amazon-linux-ami-2-upgrade-amazon-ssm-agent-debuginfo
  • amazon-linux-ami-2-upgrade-cni-plugins
  • amazon-linux-ami-2-upgrade-cni-plugins-debuginfo
  • amazon-linux-ami-2-upgrade-containerd
  • amazon-linux-ami-2-upgrade-containerd-debuginfo
  • amazon-linux-ami-2-upgrade-containerd-stress
  • amazon-linux-ami-2-upgrade-cri-tools
  • amazon-linux-ami-2-upgrade-cri-tools-debuginfo
  • amazon-linux-ami-2-upgrade-ecs-init
  • amazon-linux-ami-2-upgrade-golang
  • amazon-linux-ami-2-upgrade-golang-bin
  • amazon-linux-ami-2-upgrade-golang-docs
  • amazon-linux-ami-2-upgrade-golang-misc
  • amazon-linux-ami-2-upgrade-golang-shared
  • amazon-linux-ami-2-upgrade-golang-src
  • amazon-linux-ami-2-upgrade-golang-tests
  • amazon-linux-ami-2-upgrade-golist
  • amazon-linux-ami-2-upgrade-golist-debuginfo
  • amazon-linux-ami-2-upgrade-nerdctl
  • amazon-linux-ami-2-upgrade-nerdctl-debuginfo
  • amazon-linux-ami-2-upgrade-runc
  • amazon-linux-ami-2-upgrade-runc-debuginfo

References

  • https://attackerkb.com/topics/cve-2023-29406
  • AL2/ALAS-2023-2185
  • AL2/ALAS-2023-2186
  • AL2/ALAS-2023-2193
  • AL2/ALAS-2023-2194
  • AL2/ALAS-2023-2208
  • AL2/ALAS-2023-2303
  • AL2/ALASDOCKER-2023-028
  • AL2/ALASDOCKER-2023-029
  • AL2/ALASECS-2023-005
  • AL2/ALASECS-2024-032
  • AL2/ALASNITRO-ENCLAVES-2023-025
  • AL2/ALASNITRO-ENCLAVES-2023-026
  • CVE - 2023-29406
View more

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;