Amazon Linux 2 Security Advisory: ALASR3.4-2024-001
Advisory Release Date: 2024-06-28 19:48 Pacific
Advisory Updated Date: 2024-07-10 14:40 Pacific
Severity:
Important
Issue Overview:
Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling a maliciously crafted RDS (R Data Serialization) formatted file or R package to run arbitrary code on an end user's system when interacted with. (CVE-2024-27322)
Affected Packages:
R
Note:
This advisory is applicable to Amazon Linux 2 - R3.4 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update R to update your system.
New Packages:
aarch64:
R-3.4.3-1.amzn2.0.2.aarch64
R-core-3.4.3-1.amzn2.0.2.aarch64
R-core-devel-3.4.3-1.amzn2.0.2.aarch64
R-devel-3.4.3-1.amzn2.0.2.aarch64
R-java-3.4.3-1.amzn2.0.2.aarch64
R-java-devel-3.4.3-1.amzn2.0.2.aarch64
libRmath-3.4.3-1.amzn2.0.2.aarch64
libRmath-devel-3.4.3-1.amzn2.0.2.aarch64
libRmath-static-3.4.3-1.amzn2.0.2.aarch64
R-debuginfo-3.4.3-1.amzn2.0.2.aarch64
src:
R-3.4.3-1.amzn2.0.2.src
x86_64:
R-3.4.3-1.amzn2.0.2.x86_64
R-core-3.4.3-1.amzn2.0.2.x86_64
R-core-devel-3.4.3-1.amzn2.0.2.x86_64
R-devel-3.4.3-1.amzn2.0.2.x86_64
R-java-3.4.3-1.amzn2.0.2.x86_64
R-java-devel-3.4.3-1.amzn2.0.2.x86_64
libRmath-3.4.3-1.amzn2.0.2.x86_64
libRmath-devel-3.4.3-1.amzn2.0.2.x86_64
libRmath-static-3.4.3-1.amzn2.0.2.x86_64
R-debuginfo-3.4.3-1.amzn2.0.2.x86_64