Amazon Linux 2 Security Advisory: ALAS-2024-2385
Advisory Release Date: 2024-01-03 21:04 Pacific
Advisory Updated Date: 2024-01-09 17:58 Pacific
2024-05-08: The severity of this advisory has been changed from medium to low.
2024-05-03: CVE-2023-46218 was removed from this advisory.
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. (CVE-2023-46219)
Affected Packages:
curl
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update curl to update your system.
aarch64:
curl-8.3.0-1.amzn2.0.5.aarch64
libcurl-8.3.0-1.amzn2.0.5.aarch64
libcurl-devel-8.3.0-1.amzn2.0.5.aarch64
curl-debuginfo-8.3.0-1.amzn2.0.5.aarch64
i686:
curl-8.3.0-1.amzn2.0.5.i686
libcurl-8.3.0-1.amzn2.0.5.i686
libcurl-devel-8.3.0-1.amzn2.0.5.i686
curl-debuginfo-8.3.0-1.amzn2.0.5.i686
src:
curl-8.3.0-1.amzn2.0.5.src
x86_64:
curl-8.3.0-1.amzn2.0.5.x86_64
libcurl-8.3.0-1.amzn2.0.5.x86_64
libcurl-devel-8.3.0-1.amzn2.0.5.x86_64
curl-debuginfo-8.3.0-1.amzn2.0.5.x86_64