Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-25235: A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences (for example, from start tag names) to the XML processing application on top of expat can lead to arbitrary code execution. This issue is dependent on how invalid UTF-8 is handled inside the XML processor.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | xmlrpc-c | 0:1.32.5-1905.svn2451.amzn2.0.2 |
| Amazon Linux · 2 | xmlrpc-c-apps | 0:1.32.5-1905.svn2451.amzn2.0.2 |
| Amazon Linux · 2 | xmlrpc-c-c++ | 0:1.32.5-1905.svn2451.amzn2.0.2 |
| Amazon Linux · 2 | xmlrpc-c-client | 0:1.32.5-1905.svn2451.amzn2.0.2 |
| Amazon Linux · 2 | xmlrpc-c-client++ | 0:1.32.5-1905.svn2451.amzn2.0.2 |
| Amazon Linux · 2 | xmlrpc-c-debuginfo | 0:1.32.5-1905.svn2451.amzn2.0.2 |
| Amazon Linux · 2 | xmlrpc-c-devel | 0:1.32.5-1905.svn2451.amzn2.0.2 |
Vulnerabilities 1
-
Critical 9.8CVE-2022-25235 Public exploit
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a U…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-25235.html