Back Linuxsecurity Ubuntu 22.04: Snowflake Important Denial of Service Advisories USN-7966
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS Summary: Several security issues were fixed in Snowflake. Software Description: - snowflake: Cloud-based data platform. Details: It was discovered that Pion DTLS, vendored in Snowflake, did not impose a limit on the amount of data that was buffered during the handshake. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29189) It was discovered that Pion DTLS, vendored in Snowflake, did not prevent the fragmentBuffer from processing zero length fragments. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29190) It was discovered that Pion DTLS, vendored in Snowflake, did not require CertificateVerify when Client Cert was sent. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29222)
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS Summary: Several security issues were fixed in Snowflake. Software Description: - snowflake: Cloud-based data platform. Details: It was discovered that Pion DTLS, vendored in Snowflake, did not impose a limit on the amount of data that was buffered during the handshake. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29189) It was discovered that Pion DTLS, vendored in Snowflake, did not prevent the fragmentBuffer from processing zero length fragments. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29190) It was discovered that Pion DTLS, vendored in Snowflake, did not require CertificateVerify when Client Cert was sent. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29222)
The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS snowflake-client 1.1.0-2ubuntu0.1+esm2 Available with Ubuntu Pro snowflake-proxy 1.1.0-2ubuntu0.1+esm2 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.
The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS snowflake-client 1.1.0-2ubuntu0.1+esm2 Available with Ubuntu Pro snowflake-proxy 1.1.0-2ubuntu0.1+esm2 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
