ALAS2-2020-1400 — Important: ppp security update (Amazon Linux 2)

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-8597: eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions. 1800727: CVE-2020-8597 ppp: Buffer overflow in the eap_request and eap_response functions in eap.c

Fixed packages 3

Release	Package	Fixed in
Amazon Linux · 2	ppp	0:2.4.5-33.amzn2.0.3
Amazon Linux · 2	ppp-debuginfo	0:2.4.5-33.amzn2.0.3
Amazon Linux · 2	ppp-devel	0:2.4.5-33.amzn2.0.3

Vulnerabilities 1

Critical 9.8

CVE-2020-8597 Public exploit EPSS 20%

eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

ppp lwip lwip ppp Debian Ubuntu Azure Linux Alpine

Feb 3, 2020

References

web
https://alas.aws.amazon.com/cve/html/CVE-2020-8597.html