Amazon Linux 2 Security Advisory: ALAS-2024-2693
Advisory Release Date: 2024-11-08 18:01 Pacific
Advisory Updated Date: 2024-11-15 14:00 Pacific
Severity:
Important
Issue Overview:
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker. (CVE-2024-7254)
Affected Packages:
protobuf
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update protobuf to update your system.
New Packages:
aarch64:
protobuf-2.5.0-8.amzn2.0.5.aarch64
protobuf-compiler-2.5.0-8.amzn2.0.5.aarch64
protobuf-devel-2.5.0-8.amzn2.0.5.aarch64
protobuf-static-2.5.0-8.amzn2.0.5.aarch64
protobuf-lite-2.5.0-8.amzn2.0.5.aarch64
protobuf-lite-devel-2.5.0-8.amzn2.0.5.aarch64
protobuf-lite-static-2.5.0-8.amzn2.0.5.aarch64
protobuf-python-2.5.0-8.amzn2.0.5.aarch64
protobuf-vim-2.5.0-8.amzn2.0.5.aarch64
protobuf-emacs-2.5.0-8.amzn2.0.5.aarch64
protobuf-emacs-el-2.5.0-8.amzn2.0.5.aarch64
protobuf-java-2.5.0-8.amzn2.0.5.aarch64
protobuf-javadoc-2.5.0-8.amzn2.0.5.aarch64
protobuf-debuginfo-2.5.0-8.amzn2.0.5.aarch64
i686:
protobuf-2.5.0-8.amzn2.0.5.i686
protobuf-compiler-2.5.0-8.amzn2.0.5.i686
protobuf-devel-2.5.0-8.amzn2.0.5.i686
protobuf-static-2.5.0-8.amzn2.0.5.i686
protobuf-lite-2.5.0-8.amzn2.0.5.i686
protobuf-lite-devel-2.5.0-8.amzn2.0.5.i686
protobuf-lite-static-2.5.0-8.amzn2.0.5.i686
protobuf-python-2.5.0-8.amzn2.0.5.i686
protobuf-vim-2.5.0-8.amzn2.0.5.i686
protobuf-emacs-2.5.0-8.amzn2.0.5.i686
protobuf-emacs-el-2.5.0-8.amzn2.0.5.i686
protobuf-java-2.5.0-8.amzn2.0.5.i686
protobuf-javadoc-2.5.0-8.amzn2.0.5.i686
protobuf-debuginfo-2.5.0-8.amzn2.0.5.i686
src:
protobuf-2.5.0-8.amzn2.0.5.src
x86_64:
protobuf-2.5.0-8.amzn2.0.5.x86_64
protobuf-compiler-2.5.0-8.amzn2.0.5.x86_64
protobuf-devel-2.5.0-8.amzn2.0.5.x86_64
protobuf-static-2.5.0-8.amzn2.0.5.x86_64
protobuf-lite-2.5.0-8.amzn2.0.5.x86_64
protobuf-lite-devel-2.5.0-8.amzn2.0.5.x86_64
protobuf-lite-static-2.5.0-8.amzn2.0.5.x86_64
protobuf-python-2.5.0-8.amzn2.0.5.x86_64
protobuf-vim-2.5.0-8.amzn2.0.5.x86_64
protobuf-emacs-2.5.0-8.amzn2.0.5.x86_64
protobuf-emacs-el-2.5.0-8.amzn2.0.5.x86_64
protobuf-java-2.5.0-8.amzn2.0.5.x86_64
protobuf-javadoc-2.5.0-8.amzn2.0.5.x86_64
protobuf-debuginfo-2.5.0-8.amzn2.0.5.x86_64