Skip to content
OpenAdvisories
Medium ALAS2-2023-2032 1 CVE

Moderate: ldns security update (Amazon Linux 2)

Published Apr 27, 2023 · Updated May 2, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-19860: When ldns version 1.7.1 verifies a zone file, the ldns_rr_new_frm_str_internal function has a heap out of bounds read vulnerability. An attacker can leak information on the heap by constructing a zone file payload.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 ldns 0:1.6.16-10.amzn2.0.3
Amazon Linux · 2 ldns-debuginfo 0:1.6.16-10.amzn2.0.3
Amazon Linux · 2 ldns-devel 0:1.6.16-10.amzn2.0.3
Amazon Linux · 2 ldns-doc 0:1.6.16-10.amzn2.0.3
Amazon Linux · 2 ldns-python 0:1.6.16-10.amzn2.0.3

Vulnerabilities 1

  • Unscored —
    CVE-2020-19860

    When ldns version 1.7.1 verifies a zone file, the ldns_rr_new_frm_str_internal function has a heap out of bounds read v…

    ldns ldns Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-19860.html