ALAS-2024-2385


Amazon Linux 2 Security Advisory: ALAS-2024-2385
Advisory Release Date: 2024-01-03 21:04 Pacific
Advisory Updated Date: 2024-01-09 17:58 Pacific
Severity: Low

Issue Overview:

2024-05-08: The severity of this advisory has been changed from medium to low.

2024-05-03: CVE-2023-46218 was removed from this advisory.

When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. (CVE-2023-46219)


Affected Packages:

curl


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update curl to update your system.

New Packages:
aarch64:
    curl-8.3.0-1.amzn2.0.5.aarch64
    libcurl-8.3.0-1.amzn2.0.5.aarch64
    libcurl-devel-8.3.0-1.amzn2.0.5.aarch64
    curl-debuginfo-8.3.0-1.amzn2.0.5.aarch64

i686:
    curl-8.3.0-1.amzn2.0.5.i686
    libcurl-8.3.0-1.amzn2.0.5.i686
    libcurl-devel-8.3.0-1.amzn2.0.5.i686
    curl-debuginfo-8.3.0-1.amzn2.0.5.i686

src:
    curl-8.3.0-1.amzn2.0.5.src

x86_64:
    curl-8.3.0-1.amzn2.0.5.x86_64
    libcurl-8.3.0-1.amzn2.0.5.x86_64
    libcurl-devel-8.3.0-1.amzn2.0.5.x86_64
    curl-debuginfo-8.3.0-1.amzn2.0.5.x86_64