Skip to content
OpenAdvisories
Low ALAS2-2021-1717 1 CVE

Low: hivex security update (Amazon Linux 2)

Published Oct 28, 2021 · Updated Nov 4, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3622: A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive) file, which would cause hivex to recursively call the _get_children() function, leading to a stack overflow. The highest threat from this vulnerability is to system availability. 1975489: CVE-2021-3622 hivex: stack overflow due to recursive call of _get_children()

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 hivex 0:1.3.10-6.12.amzn2
Amazon Linux · 2 hivex-debuginfo 0:1.3.10-6.12.amzn2
Amazon Linux · 2 hivex-devel 0:1.3.10-6.12.amzn2
Amazon Linux · 2 ocaml-hivex 0:1.3.10-6.12.amzn2
Amazon Linux · 2 ocaml-hivex-devel 0:1.3.10-6.12.amzn2
Amazon Linux · 2 perl-hivex 0:1.3.10-6.12.amzn2
Amazon Linux · 2 python-hivex 0:1.3.10-6.12.amzn2
Amazon Linux · 2 ruby-hivex 0:1.3.10-6.12.amzn2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-3622.html