Lucene search

AmazonALAS2-2023-2124

HistoryJul 17, 2023 - 5:39 p.m.

Medium: iniparser

2023-07-1717:39:00

alas.aws.amazon.com

vulnerable package

iniparser

amazon linux 2

update

aarch64

i686

src

x86_64

red hat

mitre

linux

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

19.1%

JSON

Issue Overview:

iniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparser_getlongint which misses check NULL for function iniparser_getstring’s return. (CVE-2023-33461)

Affected Packages:

iniparser

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update iniparser to update your system.

New Packages:

aarch64:  
    iniparser-3.1-5.amzn2.0.3.aarch64  
    iniparser-devel-3.1-5.amzn2.0.3.aarch64  
    iniparser-debuginfo-3.1-5.amzn2.0.3.aarch64  
  
i686:  
    iniparser-3.1-5.amzn2.0.3.i686  
    iniparser-devel-3.1-5.amzn2.0.3.i686  
    iniparser-debuginfo-3.1-5.amzn2.0.3.i686  
  
src:  
    iniparser-3.1-5.amzn2.0.3.src  
  
x86_64:  
    iniparser-3.1-5.amzn2.0.3.x86_64  
    iniparser-devel-3.1-5.amzn2.0.3.x86_64  
    iniparser-debuginfo-3.1-5.amzn2.0.3.x86_64

Additional References

Red Hat: CVE-2023-33461

Mitre: CVE-2023-33461

OSVersionArchitecturePackageVersionFilename
Amazon Linux2aarch64iniparser< 3.1-5.amzn2.0.3iniparser-3.1-5.amzn2.0.3.aarch64.rpm
Amazon Linux2aarch64iniparser-devel< 3.1-5.amzn2.0.3iniparser-devel-3.1-5.amzn2.0.3.aarch64.rpm
Amazon Linux2aarch64iniparser-debuginfo< 3.1-5.amzn2.0.3iniparser-debuginfo-3.1-5.amzn2.0.3.aarch64.rpm
Amazon Linux2i686iniparser< 3.1-5.amzn2.0.3iniparser-3.1-5.amzn2.0.3.i686.rpm
Amazon Linux2i686iniparser-devel< 3.1-5.amzn2.0.3iniparser-devel-3.1-5.amzn2.0.3.i686.rpm
Amazon Linux2i686iniparser-debuginfo< 3.1-5.amzn2.0.3iniparser-debuginfo-3.1-5.amzn2.0.3.i686.rpm
Amazon Linux2x86_64iniparser< 3.1-5.amzn2.0.3iniparser-3.1-5.amzn2.0.3.x86_64.rpm
Amazon Linux2x86_64iniparser-devel< 3.1-5.amzn2.0.3iniparser-devel-3.1-5.amzn2.0.3.x86_64.rpm
Amazon Linux2x86_64iniparser-debuginfo< 3.1-5.amzn2.0.3iniparser-debuginfo-3.1-5.amzn2.0.3.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	2	aarch64	iniparser	< 3.1-5.amzn2.0.3	iniparser-3.1-5.amzn2.0.3.aarch64.rpm
Amazon Linux	2	aarch64	iniparser-devel	< 3.1-5.amzn2.0.3	iniparser-devel-3.1-5.amzn2.0.3.aarch64.rpm
Amazon Linux	2	aarch64	iniparser-debuginfo	< 3.1-5.amzn2.0.3	iniparser-debuginfo-3.1-5.amzn2.0.3.aarch64.rpm
Amazon Linux	2	i686	iniparser	< 3.1-5.amzn2.0.3	iniparser-3.1-5.amzn2.0.3.i686.rpm
Amazon Linux	2	i686	iniparser-devel	< 3.1-5.amzn2.0.3	iniparser-devel-3.1-5.amzn2.0.3.i686.rpm
Amazon Linux	2	i686	iniparser-debuginfo	< 3.1-5.amzn2.0.3	iniparser-debuginfo-3.1-5.amzn2.0.3.i686.rpm
Amazon Linux	2	x86_64	iniparser	< 3.1-5.amzn2.0.3	iniparser-3.1-5.amzn2.0.3.x86_64.rpm
Amazon Linux	2	x86_64	iniparser-devel	< 3.1-5.amzn2.0.3	iniparser-devel-3.1-5.amzn2.0.3.x86_64.rpm
Amazon Linux	2	x86_64	iniparser-debuginfo	< 3.1-5.amzn2.0.3	iniparser-debuginfo-3.1-5.amzn2.0.3.x86_64.rpm