Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-7008: systemd-resolved accepts records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.
Fixed packages 28
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | systemd | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-boot-unsigned | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-boot-unsigned-debuginfo | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-container | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-container-debuginfo | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-debuginfo | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-debugsource | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-devel | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-journal-remote | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-journal-remote-debuginfo | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-libs | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-libs-debuginfo | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-networkd | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-networkd-debuginfo | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-oomd-defaults | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-pam | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-pam-debuginfo | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-resolved | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-resolved-debuginfo | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-rpm-macros | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-standalone-sysusers | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-standalone-sysusers-debuginfo | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-standalone-tmpfiles | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-standalone-tmpfiles-debuginfo | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-tests | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-tests-debuginfo | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-udev | 0:252.16-1.amzn2023.0.2 |
| Amazon Linux · 2023 | systemd-udev-debuginfo | 0:252.16-1.amzn2023.0.2 |
Vulnerabilities 1
-
Medium 5.9
Systemd-resolved: unsigned name response in signed zone is not refused when dnssec=yes
A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-7008.html