Skip to content
OpenAdvisories
Medium ALAS2-2020-1560 1 CVE

Moderate: oniguruma security update (Amazon Linux 2)

Published Nov 9, 2020 · Updated Nov 11, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-26159: In Oniguruma 6.9.5_rev1, an attacker able to supply a regular expression for compilation may be able to overflow a buffer by one byte in concat_opt_exact_str in src/regcomp.c . 1884111: CVE-2020-26159 oniguruma: Buffer overflow in concat_opt_exact_str could result in DoS

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 oniguruma 0:5.9.6-1.amzn2.0.4
Amazon Linux · 2 oniguruma-debuginfo 0:5.9.6-1.amzn2.0.4
Amazon Linux · 2 oniguruma-devel 0:5.9.6-1.amzn2.0.4

Vulnerabilities 1

  • Unscored —
    CVE-2020-26159 Rejected

    DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Note…

    oniguruma Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-26159.html