Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-29869: A flaw was found in cifs-utils. When verbose logging is enabled, invalid credentials file lines may be dumped to stderr. This may lead to information disclosure in particular conditions when the credentials file given is sensitive and contains = signs.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | cifs-utils | 0:6.2-10.amzn2.0.4 |
| Amazon Linux · 2 | cifs-utils-debuginfo | 0:6.2-10.amzn2.0.4 |
| Amazon Linux · 2 | cifs-utils-devel | 0:6.2-10.amzn2.0.4 |
Vulnerabilities 1
-
Unscored —
cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) charac…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-29869.html