Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-27782: A vulnerability was found in curl. This issue occurs because curl can reuse a previously created connection even when a TLS or SSH-related option is changed that should have prohibited reuse. This flaw leads to an authentication bypass, either by mistake or by a malicious actor.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | curl | 0:7.79.1-4.amzn2.0.1 |
| Amazon Linux · 2 | curl-debuginfo | 0:7.79.1-4.amzn2.0.1 |
| Amazon Linux · 2 | libcurl | 0:7.79.1-4.amzn2.0.1 |
| Amazon Linux · 2 | libcurl-devel | 0:7.79.1-4.amzn2.0.1 |
Vulnerabilities 1
-
High 7.5
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should h…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-27782.html