Skip to content
OpenAdvisories
High ALAS2-2023-2016 1 CVE

Important: pki-core security update (Amazon Linux 2)

Published Apr 13, 2023 · Updated Apr 20, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-2414: Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.

Fixed packages 9

ReleasePackageFixed in
Amazon Linux · 2 pki-base 0:10.5.18-12.amzn2.0.2
Amazon Linux · 2 pki-base-java 0:10.5.18-12.amzn2.0.2
Amazon Linux · 2 pki-ca 0:10.5.18-12.amzn2.0.2
Amazon Linux · 2 pki-core-debuginfo 0:10.5.18-12.amzn2.0.2
Amazon Linux · 2 pki-javadoc 0:10.5.18-12.amzn2.0.2
Amazon Linux · 2 pki-kra 0:10.5.18-12.amzn2.0.2
Amazon Linux · 2 pki-server 0:10.5.18-12.amzn2.0.2
Amazon Linux · 2 pki-symkey 0:10.5.18-12.amzn2.0.2
Amazon Linux · 2 pki-tools 0:10.5.18-12.amzn2.0.2

Vulnerabilities 1

  • Unscored —
    CVE-2022-2414 Public exploit Scanner template EPSS 85%

    Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows …

    dogtag-pki dogtag-pki Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-2414.html