ALAS2-2023-2070: CVEs fixed (Amazon Linux)

ALAS2-2023-2070 fixes 3 tracked CVEs. Affected systems and fixed versions.

CVE-2023-27534 HIGH 8.8 UPGRADE MITIGATE A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be
CVE-2023-27536 MEDIUM 5.9 UPGRADE MITIGATE An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse p
CVE-2023-27537 MEDIUM 5.9 DOWNGRADE MITIGATE A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles"

Applies to