zlib version in ARM distribution has security vulnerability
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
### Describe the issue
The Linux ARM/aarch64 version of AWS CLI v2 in `2.17.18` has `zlib 1.2.7` in `libz.so.1`
zlib 1.2.8 has security vulnerability report on [NIST](https://nvd.nist.gov/vuln/detail/CVE-2016-9842) and [GitHub](https://github.com/advisories/GHSA-3686-jjcf-4w27) and 1.2.7 is also affected.
I am using Aqua scanner for security check and based on their report, the fixed version is 1.2.9
Do you have plan for updating zlib version 1.2.9 or above in libz.so.1?
### Additional Information/Context
CVE-2016-9842 description : The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
version in the aarch64
```
$ curl "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
./aws/install
$ strings /usr/local/aws-cli/v2/2.17.18/dist/libz.so.1 | grep "1."
inflate 1.2.7 Copyright 1995-2012 Mark Adler
```
### CLI version used
2.17.18
### Environment details (OS name and version, etc.)
Linux ARM/aarch64
Contributor guide
Assessment
This issue has not been assessed yet.