Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-29869: A flaw was found in cifs-utils. When verbose logging is enabled, invalid credentials file lines may be dumped to stderr. This may lead to information disclosure in particular conditions when the credentials file given is sensitive and contains = signs. CVE-2022-27239: A stack-based buffer overflow issue was found in pifs-utils. Parsing the mount.cifs ip command-line argument can lead to local attackers gaining root privileges.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | cifs-utils | 0:6.15-1.amzn2023.0.2 |
| Amazon Linux · 2023 | cifs-utils-debuginfo | 0:6.15-1.amzn2023.0.2 |
| Amazon Linux · 2023 | cifs-utils-debugsource | 0:6.15-1.amzn2023.0.2 |
| Amazon Linux · 2023 | cifs-utils-devel | 0:6.15-1.amzn2023.0.2 |
| Amazon Linux · 2023 | cifs-utils-info | 0:6.15-1.amzn2023.0.2 |
| Amazon Linux · 2023 | pam_cifscreds | 0:6.15-1.amzn2023.0.2 |
| Amazon Linux · 2023 | pam_cifscreds-debuginfo | 0:6.15-1.amzn2023.0.2 |
Vulnerabilities 2
-
Unscored —
In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could l…
-
Unscored —
cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) charac…