Skip to content
OpenAdvisories
Low ALAS2-2024-2636 1 CVE

Low: systemd security update (Amazon Linux 2)

Published Sep 12, 2024 · Updated Sep 18, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-31439: An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

Fixed packages 11

ReleasePackageFixed in
Amazon Linux · 2 libgudev1 0:219-78.amzn2.0.24
Amazon Linux · 2 libgudev1-devel 0:219-78.amzn2.0.24
Amazon Linux · 2 systemd 0:219-78.amzn2.0.24
Amazon Linux · 2 systemd-debuginfo 0:219-78.amzn2.0.24
Amazon Linux · 2 systemd-devel 0:219-78.amzn2.0.24
Amazon Linux · 2 systemd-journal-gateway 0:219-78.amzn2.0.24
Amazon Linux · 2 systemd-libs 0:219-78.amzn2.0.24
Amazon Linux · 2 systemd-networkd 0:219-78.amzn2.0.24
Amazon Linux · 2 systemd-python 0:219-78.amzn2.0.24
Amazon Linux · 2 systemd-resolved 0:219-78.amzn2.0.24
Amazon Linux · 2 systemd-sysv 0:219-78.amzn2.0.24

Vulnerabilities 1

  • Unscored —
    CVE-2023-31439

    An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and the…

    systemd Debian

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-31439.html