Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-6174: When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | cloud-init | 0:22.2.2-1.amzn2023.1.14 |
| Amazon Linux · 2023 | cloud-init-cfg-ec2 | 0:22.2.2-1.amzn2023.1.14 |
| Amazon Linux · 2023 | cloud-init-cfg-onprem | 0:22.2.2-1.amzn2023.1.14 |
Vulnerabilities 1
-
High 8.8
When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To preve…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-6174.html