High ALAS2-2023-2271 1 CVE

Important: curl security update (Amazon Linux 2)

Published Sep 27, 2023 · Updated Oct 5, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-38039: HTTP headers eat all memory NOTE: https://www.openwall.com/lists/oss-security/2023/09/13/1 NOTE: https://curl.se/docs/CVE-2023-38039.html NOTE: Introduced by: https://github.com/curl/curl/commit/7c8c723682d524ac9580b9ca3b71419163cb5660 (curl-7_83_0) NOTE: Experimental tag removed in: https://github.com/curl/curl/commit/4d94fac9f0d1dd02b8308291e4c47651142dc28b (curl-7_84_0) NOTE: Fixed by: https://github.com/curl/curl/commit/3ee79c1674fd6f99e8efca52cd7510e08b766770 (curl-8_3_0)

Fixed packages 4

Release	Package	Fixed in
Amazon Linux · 2	curl	0:8.3.0-1.amzn2.0.1
Amazon Linux · 2	curl-debuginfo	0:8.3.0-1.amzn2.0.1
Amazon Linux · 2	libcurl	0:8.3.0-1.amzn2.0.1
Amazon Linux · 2	libcurl-devel	0:8.3.0-1.amzn2.0.1

Vulnerabilities 1

High 7.5

CVE-2023-38039 Public exploit EPSS 56%

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl…

curl curl mysql curl Debian Ubuntu Azure Linux Alpine

Sep 15, 2023

References

web
https://alas.aws.amazon.com/cve/html/CVE-2023-38039.html