High ALAS2-2023-2071 1 CVE

Important: glusterfs security update (Amazon Linux 2)

Published Jun 5, 2023 · Updated Jun 7, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-26253: In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read.

Fixed packages 11

Release	Package	Fixed in
Amazon Linux · 2	glusterfs	0:3.12.2-18.amzn2.0.2
Amazon Linux · 2	glusterfs-api	0:3.12.2-18.amzn2.0.2
Amazon Linux · 2	glusterfs-api-devel	0:3.12.2-18.amzn2.0.2
Amazon Linux · 2	glusterfs-cli	0:3.12.2-18.amzn2.0.2
Amazon Linux · 2	glusterfs-client-xlators	0:3.12.2-18.amzn2.0.2
Amazon Linux · 2	glusterfs-debuginfo	0:3.12.2-18.amzn2.0.2
Amazon Linux · 2	glusterfs-devel	0:3.12.2-18.amzn2.0.2
Amazon Linux · 2	glusterfs-fuse	0:3.12.2-18.amzn2.0.2
Amazon Linux · 2	glusterfs-libs	0:3.12.2-18.amzn2.0.2
Amazon Linux · 2	glusterfs-rdma	0:3.12.2-18.amzn2.0.2
Amazon Linux · 2	python2-gluster	0:3.12.2-18.amzn2.0.2

Vulnerabilities 1

High 7.5

CVE-2023-26253

In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read.

glusterfs glusterfs glusterfs Debian Ubuntu Azure Linux

Feb 21, 2023

References

web
https://alas.aws.amazon.com/cve/html/CVE-2023-26253.html