Medium ALAS2023-2023-244 1 CVE

Moderate: zstd security update (Amazon Linux 2023)

Published Jul 5, 2023 · Updated Jul 20, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-4899: In zstd, supplying an empty string as an argument to either --output-dir-flat or --output-dir-mirror may cause a buffer overrun.

Fixed packages 7

Release	Package	Fixed in
Amazon Linux · 2023	libzstd	0:1.5.2-1.amzn2023.0.3
Amazon Linux · 2023	libzstd-debuginfo	0:1.5.2-1.amzn2023.0.3
Amazon Linux · 2023	libzstd-devel	0:1.5.2-1.amzn2023.0.3
Amazon Linux · 2023	libzstd-static	0:1.5.2-1.amzn2023.0.3
Amazon Linux · 2023	zstd	0:1.5.2-1.amzn2023.0.3
Amazon Linux · 2023	zstd-debuginfo	0:1.5.2-1.amzn2023.0.3
Amazon Linux · 2023	zstd-debugsource	0:1.5.2-1.amzn2023.0.3

Vulnerabilities 1

High 7.5

CVE-2022-4899

zstd vulnerable to buffer overrun

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

libzstd libzstd zstd github.com/facebook/zstd Debian Ubuntu Azure Linux PyPI SwiftURL

Mar 31, 2023

References

web
https://alas.aws.amazon.com/cve/html/CVE-2022-4899.html