aws / aws/aws-cli

zlib version in ARM distribution has security vulnerability

Open
#8,818 2 comments 0 reactions 0 assignees View on GitHub
bug p2 source-distribution
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

### Describe the issue

The Linux ARM/aarch64 version of AWS CLI v2 in `2.17.18` has `zlib 1.2.7` in `libz.so.1`

zlib 1.2.8 has security vulnerability report on [NIST](https://nvd.nist.gov/vuln/detail/CVE-2016-9842) and [GitHub](https://github.com/advisories/GHSA-3686-jjcf-4w27) and 1.2.7 is also affected.

I am using Aqua scanner for security check and based on their report, the fixed version is 1.2.9
Do you have plan for updating zlib version 1.2.9 or above in libz.so.1?

### Additional Information/Context

CVE-2016-9842 description : The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

version in the aarch64
```
$ curl "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
./aws/install

$ strings /usr/local/aws-cli/v2/2.17.18/dist/libz.so.1 | grep "1."
inflate 1.2.7 Copyright 1995-2012 Mark Adler
```

### CLI version used

2.17.18

### Environment details (OS name and version, etc.)

Linux ARM/aarch64

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.