SB2023041603 - SUSE update for aws-nitro-enclaves-cli

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2022-24713)

The vulnerability allows a remote attacker to perform a denial of service (ReDoS) attack.

The vulnerability exists due regex for Rust does not properly control consumption of internal resources when parsing untrusted input. A remote attacker can pass specially crafted data to the application and perform a regular expression denial of service (ReDoS) attack.

2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2022-31394)

The vulnerability allows a remote attacker to perform DoS attack.

The vulnerability exists due to the library does not allow customization of the max_header_list_size method in the H2 third-party software. A remote attacker can send overly large requests to the application and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2023/suse-su-20231844-1/