Amazon Linux 2023 Security Advisory: ALAS-2024-530
Advisory Release Date: 2024-02-15 02:52 Pacific
Advisory Updated Date: 2024-02-19 20:26 Pacific
Severity:
Important
Issue Overview:
A stack-based buffer overflow issue was found in pifs-utils. Parsing the mount.cifs ip command-line argument can lead to local attackers gaining root privileges. (CVE-2022-27239)
A flaw was found in cifs-utils. When verbose logging is enabled, invalid credentials file lines may be dumped to stderr. This may lead to information disclosure in particular conditions when the credentials file given is sensitive and contains = signs. (CVE-2022-29869)
Affected Packages:
cifs-utils
Issue Correction:
Run dnf update cifs-utils --releasever 2023.3.20240219 to update your system.
New Packages:
aarch64:
cifs-utils-devel-6.15-1.amzn2023.0.2.aarch64
pam_cifscreds-6.15-1.amzn2023.0.2.aarch64
cifs-utils-debuginfo-6.15-1.amzn2023.0.2.aarch64
cifs-utils-debugsource-6.15-1.amzn2023.0.2.aarch64
cifs-utils-info-6.15-1.amzn2023.0.2.aarch64
pam_cifscreds-debuginfo-6.15-1.amzn2023.0.2.aarch64
cifs-utils-6.15-1.amzn2023.0.2.aarch64
src:
cifs-utils-6.15-1.amzn2023.0.2.src
x86_64:
cifs-utils-debugsource-6.15-1.amzn2023.0.2.x86_64
cifs-utils-debuginfo-6.15-1.amzn2023.0.2.x86_64
pam_cifscreds-debuginfo-6.15-1.amzn2023.0.2.x86_64
pam_cifscreds-6.15-1.amzn2023.0.2.x86_64
cifs-utils-info-6.15-1.amzn2023.0.2.x86_64
cifs-utils-6.15-1.amzn2023.0.2.x86_64
cifs-utils-devel-6.15-1.amzn2023.0.2.x86_64