Skip to content
OpenAdvisories
Medium ALAS2023-2023-266 1 CVE

Moderate: janino security update (Amazon Linux 2023)

Published Jul 19, 2023 · Updated Jul 26, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-33546: janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2023 commons-compiler 0:3.1.7-1.amzn2023.0.2
Amazon Linux · 2023 commons-compiler-jdk 0:3.1.7-1.amzn2023.0.2
Amazon Linux · 2023 janino 0:3.1.7-1.amzn2023.0.2
Amazon Linux · 2023 janino-javadoc 0:3.1.7-1.amzn2023.0.2

Vulnerabilities 1

  • Medium 5.5
    CVE-2023-33546

    janino vulnerable to denial of service due to stack overflow

    Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack…

    org.codehaus.janino:janino-parent janino Debian Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-33546.html