Medium: gsl

2023-09-2722:15:00

alas.aws.amazon.com

buffer overflow

gnu scientific library

cve-2020-35357

update

red hat

mitre

unix

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

42.7%

JSON

Issue Overview:

A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution. (CVE-2020-35357)

Affected Packages:

gsl

Issue Correction:
Run yum update gsl to update your system.

New Packages:

i686:  
    gsl-debuginfo-1.13-4.4.amzn1.i686  
    gsl-1.13-4.4.amzn1.i686  
    gsl-static-1.13-4.4.amzn1.i686  
    gsl-devel-1.13-4.4.amzn1.i686  
  
src:  
    gsl-1.13-4.4.amzn1.src  
  
x86_64:  
    gsl-debuginfo-1.13-4.4.amzn1.x86_64  
    gsl-static-1.13-4.4.amzn1.x86_64  
    gsl-devel-1.13-4.4.amzn1.x86_64  
    gsl-1.13-4.4.amzn1.x86_64

Additional References

Red Hat: CVE-2020-35357

Mitre: CVE-2020-35357

OSVersionArchitecturePackageVersionFilename
Amazon Linux1i686gsl-debuginfo< 1.13-4.4.amzn1gsl-debuginfo-1.13-4.4.amzn1.i686.rpm
Amazon Linux1i686gsl< 1.13-4.4.amzn1gsl-1.13-4.4.amzn1.i686.rpm
Amazon Linux1i686gsl-static< 1.13-4.4.amzn1gsl-static-1.13-4.4.amzn1.i686.rpm
Amazon Linux1i686gsl-devel< 1.13-4.4.amzn1gsl-devel-1.13-4.4.amzn1.i686.rpm
Amazon Linux1x86_64gsl-debuginfo< 1.13-4.4.amzn1gsl-debuginfo-1.13-4.4.amzn1.x86_64.rpm
Amazon Linux1x86_64gsl-static< 1.13-4.4.amzn1gsl-static-1.13-4.4.amzn1.x86_64.rpm
Amazon Linux1x86_64gsl-devel< 1.13-4.4.amzn1gsl-devel-1.13-4.4.amzn1.x86_64.rpm
Amazon Linux1x86_64gsl< 1.13-4.4.amzn1gsl-1.13-4.4.amzn1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	1	i686	gsl-debuginfo	< 1.13-4.4.amzn1	gsl-debuginfo-1.13-4.4.amzn1.i686.rpm
Amazon Linux	1	i686	gsl	< 1.13-4.4.amzn1	gsl-1.13-4.4.amzn1.i686.rpm
Amazon Linux	1	i686	gsl-static	< 1.13-4.4.amzn1	gsl-static-1.13-4.4.amzn1.i686.rpm
Amazon Linux	1	i686	gsl-devel	< 1.13-4.4.amzn1	gsl-devel-1.13-4.4.amzn1.i686.rpm
Amazon Linux	1	x86_64	gsl-debuginfo	< 1.13-4.4.amzn1	gsl-debuginfo-1.13-4.4.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	gsl-static	< 1.13-4.4.amzn1	gsl-static-1.13-4.4.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	gsl-devel	< 1.13-4.4.amzn1	gsl-devel-1.13-4.4.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	gsl	< 1.13-4.4.amzn1	gsl-1.13-4.4.amzn1.x86_64.rpm