Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:22145-1

Опубликовано: 20 окт. 2026
Источник: suse-cvrf

Описание

Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issues:

  • CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1279042).
  • CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280679).

Changes for amazon-ecs-init:

  • Update to version 1.108.0
  • Enhancement - Add ECS-Init install pointer for non-Amazon Linux AMIs to README (#5161)
  • Enhancement - Remove direct docker run instructions from README (#5160)
  • Enhancement - Bump github.com/aws/aws-sdk-go-v2/config from 1.28.1 to 1.33.6 in /ecs-agent, /agent, and /ecs-init (#5159)
  • Feature - Enable IMDS IAM roles config resolution (#5154)
  • Enhancement - Bump github.com/containerd/containerd from 1.7.33 to 1.7.36 in /agent (#5155)
  • Enhancement - Bump github.com/containerd/containerd from 1.7.35 to 1.7.36 in /ecs-init (#5156)
  • Enhancement - Bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.195.0 to 1.334.0 in /ecs-agent and /agent (#5148)
  • Enhancement - Bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /ecs-agent, /ecs-agent/daemonimages/csidriver and /agent (#5153) (bsc#1279042, CVE-2026-84445)
  • Enhancement - Bump go.opentelemetry.io/otel/exporters/otlp/ otlptrace/otlptracehttp from 1.43.0 to 1.45.0 in /agent (#5141)
  • Enhancement - IMDS credential scanner/refresher updates (#5145)

Список пакетов

openSUSE Leap 16.0
amazon-ecs-init-1.108.0-160000.1.1

Ссылки

Описание

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.

Затронутые продукты
openSUSE Leap 16.0:amazon-ecs-init-1.108.0-160000.1.1
Ссылки

Описание

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range. To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.

Затронутые продукты
openSUSE Leap 16.0:amazon-ecs-init-1.108.0-160000.1.1
Ссылки