Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-2553: The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | booth | 0:1.0-8.ef769ef.git.amzn2.0.1 |
| Amazon Linux · 2 | booth-arbitrator | 0:1.0-8.ef769ef.git.amzn2.0.1 |
| Amazon Linux · 2 | booth-core | 0:1.0-8.ef769ef.git.amzn2.0.1 |
| Amazon Linux · 2 | booth-debuginfo | 0:1.0-8.ef769ef.git.amzn2.0.1 |
| Amazon Linux · 2 | booth-site | 0:1.0-8.ef769ef.git.amzn2.0.1 |
| Amazon Linux · 2 | booth-test | 0:1.0-8.ef769ef.git.amzn2.0.1 |
Vulnerabilities 1
-
Unscored —
The authfile directive in the booth config file is ignored, preventing use of authentication in communications from nod…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-2553.html