Skip to content
OpenAdvisories
High ALAS2-2023-1994 1 CVE

Important: tar security update (Amazon Linux 2)

Published Mar 17, 2023 · Updated Mar 21, 2023

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-48303: GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 tar 2:1.26-35.amzn2.0.1
Amazon Linux · 2 tar-debuginfo 2:1.26-35.amzn2.0.1

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-48303.html