Amazon Linux 2023 Security Advisory: ALAS-2024-475
Advisory Release Date: 2024-01-03 23:20 Pacific
Advisory Updated Date: 2024-01-08 21:02 Pacific
Severity:
Low
Issue Overview:
It was discovered that tar incorrectly handled extended attributes in PAX archives. An attacker could supply a specially crafted file and cause tar to crash, resulting in a denial of service. (CVE-2023-39804)
Affected Packages:
tar
Issue Correction:
Run dnf update tar --releasever 2023.3.20240108 to update your system.
New Packages:
aarch64:
tar-debuginfo-1.34-1.amzn2023.0.4.aarch64
tar-1.34-1.amzn2023.0.4.aarch64
tar-debugsource-1.34-1.amzn2023.0.4.aarch64
src:
tar-1.34-1.amzn2023.0.4.src
x86_64:
tar-debuginfo-1.34-1.amzn2023.0.4.x86_64
tar-1.34-1.amzn2023.0.4.x86_64
tar-debugsource-1.34-1.amzn2023.0.4.x86_64