Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-37434: A security vulnerability was found in zlib. The flaw triggered a heap-based buffer in inflate in the inflate.c function via a large gzip header extra field. This flaw is only applicable in the call inflateGetHeader.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | minizip | 0:1.2.7-19.amzn2.0.2 |
| Amazon Linux · 2 | minizip-devel | 0:1.2.7-19.amzn2.0.2 |
| Amazon Linux · 2 | zlib | 0:1.2.7-19.amzn2.0.2 |
| Amazon Linux · 2 | zlib-debuginfo | 0:1.2.7-19.amzn2.0.2 |
| Amazon Linux · 2 | zlib-devel | 0:1.2.7-19.amzn2.0.2 |
| Amazon Linux · 2 | zlib-static | 0:1.2.7-19.amzn2.0.2 |
Vulnerabilities 1
-
Critical 9.8
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip heade…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-37434.html