Low: curl

Issue Overview:

2024-05-08: The severity of this advisory has been changed from medium to low.

2024-05-03: CVE-2023-46218 was removed from this advisory.

When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. (CVE-2023-46219)

Affected Packages:

curl

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update curl to update your system.

New Packages:

aarch64:  
    curl-8.3.0-1.amzn2.0.5.aarch64  
    libcurl-8.3.0-1.amzn2.0.5.aarch64  
    libcurl-devel-8.3.0-1.amzn2.0.5.aarch64  
    curl-debuginfo-8.3.0-1.amzn2.0.5.aarch64  
  
i686:  
    curl-8.3.0-1.amzn2.0.5.i686  
    libcurl-8.3.0-1.amzn2.0.5.i686  
    libcurl-devel-8.3.0-1.amzn2.0.5.i686  
    curl-debuginfo-8.3.0-1.amzn2.0.5.i686  
  
src:  
    curl-8.3.0-1.amzn2.0.5.src  
  
x86_64:  
    curl-8.3.0-1.amzn2.0.5.x86_64  
    libcurl-8.3.0-1.amzn2.0.5.x86_64  
    libcurl-devel-8.3.0-1.amzn2.0.5.x86_64  
    curl-debuginfo-8.3.0-1.amzn2.0.5.x86_64  

Additional References

Red Hat: CVE-2023-46219

Mitre: CVE-2023-46219