Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-11065: go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | nerdctl | 0:2.1.5-1.amzn2.0.1 |
| Amazon Linux · 2 | nerdctl-debuginfo | 0:2.1.5-1.amzn2.0.1 |
Vulnerabilities 1
-
Medium 5.3
Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-11065.html