# ALAS2023-2023-048: Security update for 8 packages ALAS2023-2023-048, released February 17, 2023, fixes 27 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/alas2023-2023-048 - Platform: Linux - Released: Feb 17, 2023 - Priority: High (Closes CVE-2021-38297, high severity) - CVEs: 27, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2023-048.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [golang](https://patchblox.com/security/data/product/linux/golang.md) | amzn 2023 | 1.19.3-2.amzn2023.0.2 | | [golang-bin](https://patchblox.com/security/data/product/linux/golang-bin.md) | amzn 2023 | 1.19.3-2.amzn2023.0.2 | | [golang-docs](https://patchblox.com/security/data/product/linux/golang-docs.md) | amzn 2023 | 1.19.3-2.amzn2023.0.2 | | [golang-misc](https://patchblox.com/security/data/product/linux/golang-misc.md) | amzn 2023 | 1.19.3-2.amzn2023.0.2 | | [golang-race](https://patchblox.com/security/data/product/linux/golang-race.md) | amzn 2023 | 1.19.3-2.amzn2023.0.2 | | [golang-shared](https://patchblox.com/security/data/product/linux/golang-shared.md) | amzn 2023 | 1.19.3-2.amzn2023.0.2 | | [golang-src](https://patchblox.com/security/data/product/linux/golang-src.md) | amzn 2023 | 1.19.3-2.amzn2023.0.2 | | [golang-tests](https://patchblox.com/security/data/product/linux/golang-tests.md) | amzn 2023 | 1.19.3-2.amzn2023.0.2 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2021-38297](https://patchblox.com/security/data/cve/CVE-2021-38297.md) | High | delve: Go Toolset provides the Go programming language tools and libraries | 9.8 | 0.1096 | | | [CVE-2022-24675](https://patchblox.com/security/data/cve/CVE-2022-24675.md) | High | golang-1.18: encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. | 7.5 | 0.0995 | | | [CVE-2021-41771](https://patchblox.com/security/data/cve/CVE-2021-41771.md) | High | delve: Go Toolset provides the Go programming language tools and libraries | 9.8 | 0.0470 | | | [CVE-2021-44716](https://patchblox.com/security/data/cve/CVE-2021-44716.md) | High | google-guest-agent: net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolledmemory consumption in the header canonicali... | 7.5 | 0.0425 | | | [CVE-2022-28327](https://patchblox.com/security/data/cve/CVE-2022-28327.md) | High | golang-1.18-src: The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long sca... | 7.5 | 0.0416 | | | [CVE-2022-27191](https://patchblox.com/security/data/cve/CVE-2022-27191.md) | High | docker-stable: This update for docker-stable fixes the following issues: Note this update contains a already fixed references mostl... | 7.5 | 0.0396 | | | [CVE-2022-27664](https://patchblox.com/security/data/cve/CVE-2022-27664.md) | High | golang-1.13: In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 c... | 7.5 | 0.0349 | | | [CVE-2021-33196](https://patchblox.com/security/data/cve/CVE-2021-33196.md) | High | delve: Go Toolset provides the Go programming language tools and libraries | 7.5 | 0.0346 | | | [CVE-2021-41772](https://patchblox.com/security/data/cve/CVE-2021-41772.md) | High | delve: Go Toolset provides the Go programming language tools and libraries | 9.8 | 0.0325 | | | [CVE-2022-24921](https://patchblox.com/security/data/cve/CVE-2022-24921.md) | High | delve: Go Toolset provides the Go programming language tools and libraries | 7.5 | 0.0323 | | | [CVE-2022-29526](https://patchblox.com/security/data/cve/CVE-2022-29526.md) | High | golang-1.18: Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment | 7.5 | 0.0295 | | | [CVE-2022-32189](https://patchblox.com/security/data/cve/CVE-2022-32189.md) | High | git-lfs: Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text poi... | 7.5 | 0.0278 | | | [CVE-2022-28131](https://patchblox.com/security/data/cve/CVE-2022-28131.md) | High | golang-1.13-go: Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a... | 7.5 | 0.0256 | | | [CVE-2022-32190](https://patchblox.com/security/data/cve/CVE-2022-32190.md) | High | golang-1.19: JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path | 7.5 | 0.0230 | | | [CVE-2022-30633](https://patchblox.com/security/data/cve/CVE-2022-30633.md) | High | delve: Go Toolset provides the Go programming language tools and libraries | 7.5 | 0.0221 | | | [CVE-2022-30630](https://patchblox.com/security/data/cve/CVE-2022-30630.md) | High | delve: Go Toolset provides the Go programming language tools and libraries | 7.5 | 0.0219 | | | [CVE-2022-30632](https://patchblox.com/security/data/cve/CVE-2022-30632.md) | High | delve: Go Toolset provides the Go programming language tools and libraries | 7.5 | 0.0219 | | | [CVE-2022-30631](https://patchblox.com/security/data/cve/CVE-2022-30631.md) | High | delve: Go Toolset provides the Go programming language tools and libraries | 7.5 | 0.0219 | | | [CVE-2022-2879](https://patchblox.com/security/data/cve/CVE-2022-2879.md) | High | delve: Go Toolset provides the Go programming language tools and libraries | 7.5 | 0.0201 | | | [CVE-2021-44717](https://patchblox.com/security/data/cve/CVE-2021-44717.md) | High | delve: Go Toolset provides the Go programming language tools and libraries | 7.5 | 0.0200 | | | [CVE-2022-30635](https://patchblox.com/security/data/cve/CVE-2022-30635.md) | High | delve: Go Toolset provides the Go programming language tools and libraries | 7.5 | 0.0192 | | | [CVE-2022-41715](https://patchblox.com/security/data/cve/CVE-2022-41715.md) | High | golang-github-prometheus-prometheus: This update for golang-github-prometheus-prometheus fixes the following issues: - Require Go > 1.20 for building -... | 7.5 | 0.0173 | | | [CVE-2022-1705](https://patchblox.com/security/data/cve/CVE-2022-1705.md) | High | aardvark-dns: The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Se... | 7.5 | 0.0153 | | | [CVE-2022-32148](https://patchblox.com/security/data/cve/CVE-2022-32148.md) | High | delve: Go Toolset provides the Go programming language tools and libraries | 7.5 | 0.0152 | | | [CVE-2022-30629](https://patchblox.com/security/data/cve/CVE-2022-30629.md) | High | delve: Go Toolset provides the Go programming language tools and libraries | 7.5 | 0.0121 | | | [CVE-2022-41716](https://patchblox.com/security/data/cve/CVE-2022-41716.md) | High | golang-1.19: Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows | 7.5 | 0.0103 | | | [CVE-2022-1962](https://patchblox.com/security/data/cve/CVE-2022-1962.md) | High | delve: Go Toolset provides the Go programming language tools and libraries | 7.5 | 0.0092 | | --- Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.