Amazon Linux 2 Security Advisory: ALASR4-2024-002
Advisory Release Date: 2024-06-19 20:39 Pacific
Advisory Updated Date: 2024-06-24 11:30 Pacific
Severity:
Important
Issue Overview:
Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling a maliciously crafted RDS (R Data Serialization) formatted file or R package to run arbitrary code on an end user's system when interacted with. (CVE-2024-27322)
Affected Packages:
R
Note:
This advisory is applicable to Amazon Linux 2 - R4 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update R to update your system.
New Packages:
aarch64:
R-4.0.2-5.amzn2.0.3.aarch64
R-core-4.0.2-5.amzn2.0.3.aarch64
R-core-devel-4.0.2-5.amzn2.0.3.aarch64
R-devel-4.0.2-5.amzn2.0.3.aarch64
R-java-4.0.2-5.amzn2.0.3.aarch64
R-java-devel-4.0.2-5.amzn2.0.3.aarch64
libRmath-4.0.2-5.amzn2.0.3.aarch64
libRmath-devel-4.0.2-5.amzn2.0.3.aarch64
libRmath-static-4.0.2-5.amzn2.0.3.aarch64
R-debuginfo-4.0.2-5.amzn2.0.3.aarch64
src:
R-4.0.2-5.amzn2.0.3.src
x86_64:
R-4.0.2-5.amzn2.0.3.x86_64
R-core-4.0.2-5.amzn2.0.3.x86_64
R-core-devel-4.0.2-5.amzn2.0.3.x86_64
R-devel-4.0.2-5.amzn2.0.3.x86_64
R-java-4.0.2-5.amzn2.0.3.x86_64
R-java-devel-4.0.2-5.amzn2.0.3.x86_64
libRmath-4.0.2-5.amzn2.0.3.x86_64
libRmath-devel-4.0.2-5.amzn2.0.3.x86_64
libRmath-static-4.0.2-5.amzn2.0.3.x86_64
R-debuginfo-4.0.2-5.amzn2.0.3.x86_64