ALAS2023-2024-633 — Moderate: fdupes security update (Amazon Linux 2023)

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-48682: In deletefiles in FDUPES before 2.2.0, a TOCTOU race condition allows arbitrary file deletion via a symlink.

Fixed packages 3

Release	Package	Fixed in
Amazon Linux · 2023	fdupes	1:2.3.0-1.amzn2023
Amazon Linux · 2023	fdupes-debuginfo	1:2.3.0-1.amzn2023
Amazon Linux · 2023	fdupes-debugsource	1:2.3.0-1.amzn2023

Vulnerabilities 1

Medium 6.0

CVE-2022-48682

In deletefiles in FDUPES before 2.2.0, a TOCTOU race condition allows arbitrary file deletion via a symlink.

fdupes fdupes Debian Ubuntu

Apr 26, 2024

References

web
https://alas.aws.amazon.com/cve/html/CVE-2022-48682.html