Skip to content
OpenAdvisories
Low ALAS2-2024-2619 1 CVE

Low: protobuf-c security update (Amazon Linux 2)

Published Aug 1, 2024 · Updated Aug 13, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-33070: Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 protobuf-c 0:1.0.2-3.amzn2.0.3
Amazon Linux · 2 protobuf-c-compiler 0:1.0.2-3.amzn2.0.3
Amazon Linux · 2 protobuf-c-debuginfo 0:1.0.2-3.amzn2.0.3
Amazon Linux · 2 protobuf-c-devel 0:1.0.2-3.amzn2.0.3

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-33070.html