ALAS2023-2026-1422

Details

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2019-13232: Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.

Affected Packages

unzip

AmazonLinux 2023

Fixed in:

6.0-68.amzn2023.0.1

unzip-debuginfo

AmazonLinux 2023

Fixed in:

6.0-68.amzn2023.0.1

unzip-debugsource

AmazonLinux 2023

Fixed in:

6.0-68.amzn2023.0.1

References

ADVISORY

https://alas.aws.amazon.com/AL2023/ALAS2023-2026-1422.html