Lucene search

AmazonALAS-2024-2461

HistoryFeb 15, 2024 - 3:52 a.m.

Medium: jtidy

2024-02-1503:52:00

alas.aws.amazon.com

jtidy

vulnerability

denial of service

crafted object

cyclic dependencies

amazon linux 2

update

cve-2023-34623

noarch

src

red hat

mitre

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.0%

JSON

Issue Overview:

An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. (CVE-2023-34623)

Affected Packages:

jtidy

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update jtidy to update your system.

New Packages:

noarch:  
    jtidy-1.0-0.16.20100930svn1125.amzn2.0.1.noarch  
    jtidy-javadoc-1.0-0.16.20100930svn1125.amzn2.0.1.noarch  
  
src:  
    jtidy-1.0-0.16.20100930svn1125.amzn2.0.1.src

Additional References

Red Hat: CVE-2023-34623

Mitre: CVE-2023-34623

OSVersionArchitecturePackageVersionFilename
Amazon Linux2noarchjtidy< 1.0-0.16.20100930svn1125.amzn2.0.1jtidy-1.0-0.16.20100930svn1125.amzn2.0.1.noarch.rpm
Amazon Linux2noarchjtidy-javadoc< 1.0-0.16.20100930svn1125.amzn2.0.1jtidy-javadoc-1.0-0.16.20100930svn1125.amzn2.0.1.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	2	noarch	jtidy	< 1.0-0.16.20100930svn1125.amzn2.0.1	jtidy-1.0-0.16.20100930svn1125.amzn2.0.1.noarch.rpm
Amazon Linux	2	noarch	jtidy-javadoc	< 1.0-0.16.20100930svn1125.amzn2.0.1	jtidy-javadoc-1.0-0.16.20100930svn1125.amzn2.0.1.noarch.rpm