Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2014-4617: The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence. 1112509: CVE-2014-4617 gnupg: infinite loop when decompressing data packets
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | gnupg2 | 0:2.0.22-5.amzn2.0.3 |
| Amazon Linux · 2 | gnupg2-debuginfo | 0:2.0.22-5.amzn2.0.3 |
| Amazon Linux · 2 | gnupg2-smime | 0:2.0.22-5.amzn2.0.3 |
Vulnerabilities 1
-
Unscored —
The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2014-4617.html