Debian alert DLA-4080-1 (libaws)

From:
             
 
Andreas Henriksson <andreas@fatal.se>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4080-1] libaws security update
Date:
             
 
Mon, 10 Mar 2025 19:03:01 +0100
Message-ID:
             
 
<msskqproxztcmtq3mqec3ousc6j7sryxgzzsgdwbu3nn7b6vuq@veunplqnug6z>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4080-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                   Andreas Henriksson
March 09, 2025                                https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : libaws
Version        : 20.2-2+deb11u1
CVE ID         : CVE-2024-55581
Debian Bug     :

AdaCore released a security advisory for
"Insecure defaults in AWS.Client when linked with GnuTLS".
The debian package of libaws is built with GnuTLS and the reproducer
included in the advisory was used to confirm the (previous version of)
the package was affected. The upstream fix was backported to the
packaged version to address the problem.

For Debian 11 bullseye, this problem has been fixed in version
20.2-2+deb11u1.

We recommend that you upgrade your libaws packages.

For the detailed security status of libaws please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libaws

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+uHltkZSvnmOJ4zCC8R9xk0TUwYFAmfPKVUACgkQC8R9xk0T
UwbwHg//WCURxFQ883eCswRZja2ZhrbGnmoG6lR6OpciO323dVSZkh4s83bI4VxB
tkLYWg5c2tbw5FTFc7EOnDQ0TgFCGcYYg03DVS/OPPQh0nrLbQUgZX4Kx3aQ8i0O
XMk/SpWwdDA9ZWRHef8ecUQEl2C47GKHt29d9ohfI5o8nvCTlFPbGvTtVtr6z9m0
hwC7iiQn451Jgf3YM6RTjVokzU/1ZuycPB6One/wwSXe5oTfwJ2PTz4KjUvidEi2
A0YircUaGhZbdiNoHCK7qyHBR+hsPe68BPfx1O+ZtajlBKcvnh2pFUCcWflhjS1Z
D/aspq7cGhA6Q0hT+lNip18k5FKAWi/08QUglYNuW3OQqRBXGQGDLuguVdlCu23m
ImWemRrUeGLKaHrfvErEeT0QISVv8vDeJqivEx3QemwMrbTVLrWn3Vc8MbqUpjXW
BNnkDK0iSHeZh5S9CMjhh8+qtK9+6kwOgzokulWXTlNfTXGPr6c3VGH9IGjkFzIb
LKOQSRGGzrAUHKsHEEBVtQxTddY5T/n+fz1JMf3RQoMQ6Hcj/JiBPr2KBFnjsF5e
ATKLaslFvk19nu1RcKlbTAXtz/Re57XGn/aKPKc8laBnsmU2jDsKzYSkcoi1daFH
HioyZtJAo+VTQvLkXG0u449UbUCTv1KL9B5cRjzz0jqOQLxS0rY=
=nXEP
-----END PGP SIGNATURE-----