Amazon Linux 2023 Security Advisory: ALAS-2024-472
Advisory Release Date: 2024-01-03 23:20 Pacific
Advisory Updated Date: 2024-01-08 21:02 Pacific
Severity:
Low
Issue Overview:
2024-05-08: The severity of this advisory has been changed from medium to low.
2024-05-03: CVE-2023-46218 was removed from this advisory.
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. (CVE-2023-46219)
Affected Packages:
curl
Issue Correction:
Run dnf update curl --releasever 2023.3.20240108 to update your system.
New Packages:
aarch64:
curl-minimal-debuginfo-8.5.0-1.amzn2023.0.1.aarch64
curl-minimal-8.5.0-1.amzn2023.0.1.aarch64
curl-debuginfo-8.5.0-1.amzn2023.0.1.aarch64
libcurl-debuginfo-8.5.0-1.amzn2023.0.1.aarch64
libcurl-minimal-8.5.0-1.amzn2023.0.1.aarch64
libcurl-minimal-debuginfo-8.5.0-1.amzn2023.0.1.aarch64
curl-debugsource-8.5.0-1.amzn2023.0.1.aarch64
libcurl-8.5.0-1.amzn2023.0.1.aarch64
curl-8.5.0-1.amzn2023.0.1.aarch64
libcurl-devel-8.5.0-1.amzn2023.0.1.aarch64
src:
curl-8.5.0-1.amzn2023.0.1.src
x86_64:
curl-debuginfo-8.5.0-1.amzn2023.0.1.x86_64
curl-minimal-debuginfo-8.5.0-1.amzn2023.0.1.x86_64
libcurl-debuginfo-8.5.0-1.amzn2023.0.1.x86_64
libcurl-minimal-debuginfo-8.5.0-1.amzn2023.0.1.x86_64
curl-minimal-8.5.0-1.amzn2023.0.1.x86_64
libcurl-8.5.0-1.amzn2023.0.1.x86_64
libcurl-minimal-8.5.0-1.amzn2023.0.1.x86_64
curl-8.5.0-1.amzn2023.0.1.x86_64
libcurl-devel-8.5.0-1.amzn2023.0.1.x86_64
curl-debugsource-8.5.0-1.amzn2023.0.1.x86_64