Moderate: zlib security update
Summary
ALSA-2022:7106: Moderate: zlib security update. Affects zlib versions < 1.2.11-19.el8_6. Fixed in 1.2.11-19.el8_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The zlib package is a widely used general-purpose lossless data compression library. It is utilized by numerous programs for compressing and decompressing data. This vulnerability affects the zlib package in AlmaLinux 8.
Vulnerability Detail
The vulnerability, identified as CVE-2022-37434, is a heap-based buffer over-read or buffer overflow in the inflate function of zlib's inflate.c file. It occurs when processing a large gzip header extra field. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition.
How To Fix
Minimum fixed version
1.2.11-19.el8_6
This is the first release that contains the fix.
sudo dnf update zlibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible.
Conclusion
In conclusion, the zlib package in AlmaLinux 8 is affected by a moderate security vulnerability (CVE-2022-37434). It is crucial to update the zlib package to version 1.2.11-19.el8_6 or later to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for zlib →
FAQ
This vulnerability could allow an attacker to execute arbitrary code or cause a denial-of-service condition.
The vulnerability affects versions prior to 1.2.11-19.el8_6 of the zlib package in AlmaLinux 8.
At the time of this advisory, there is no known public exploit for this vulnerability.
The only effective mitigation is to update the zlib package to the fixed version.
You can refer to the CVE page for CVE-2022-37434 for more details about the vulnerability, including its CVSS score and acknowledgments.
Related vulnerabilities
Recent vulnerabilities recorded for zlib.
