Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2019-13232: Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | unzip | 0:6.0-68.amzn2023.0.1 |
| Amazon Linux · 2023 | unzip-debuginfo | 0:6.0-68.amzn2023.0.1 |
| Amazon Linux · 2023 | unzip-debugsource | 0:6.0-68.amzn2023.0.1 |
Vulnerabilities 1
-
Unscored —
Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource c…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-13232.html