Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-53605: The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | cargo | 0:1.86.0-1.amzn2.0.2 |
| Amazon Linux · 2 | clippy | 0:1.86.0-1.amzn2.0.2 |
| Amazon Linux · 2 | rust | 0:1.86.0-1.amzn2.0.2 |
| Amazon Linux · 2 | rust-analyzer | 0:1.86.0-1.amzn2.0.2 |
| Amazon Linux · 2 | rust-debugger-common | 0:1.86.0-1.amzn2.0.2 |
| Amazon Linux · 2 | rust-doc | 0:1.86.0-1.amzn2.0.2 |
| Amazon Linux · 2 | rust-gdb | 0:1.86.0-1.amzn2.0.2 |
| Amazon Linux · 2 | rust-src | 0:1.86.0-1.amzn2.0.2 |
| Amazon Linux · 2 | rust-std-static | 0:1.86.0-1.amzn2.0.2 |
| Amazon Linux · 2 | rust-toolset | 0:1.86.0-1.amzn2.0.2 |
| Amazon Linux · 2 | rust-toolset-srpm-macros | 0:1.86.0-1.amzn2.0.2 |
| Amazon Linux · 2 | rustfmt | 0:1.86.0-1.amzn2.0.2 |
Vulnerabilities 1
-
Medium 5.9
Crash due to uncontrolled recursion in protobuf crate
The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-53605.html