CVE-2026-89161 (HIGH): detected in Lambda Docker Images.

Chiusa
  • Qualcosa non va?
#699 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
aws, docker
Ambito
cloud, devops, infrastructure, security

Direzione di ricerca

No repository file or test is named. Start by locating how the listed Lambda Docker images are built and where the Amazon Linux package version is defined; verify the affected images use pcre2 10.40-1.amzn2023.0.4 and confirm the resulting image set no longer reports this CVE.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

CVE Details

CVE ID Severity Affected Package Installed Version Fixed Version Date Published Date of Scan
CVE-2026-89161 HIGH pcre2 10.40-1.amzn2023.0.3 10.40-1.amzn2023.0.4 2026-09-11T04:18:04.47Z 2026-09-30T10:18:15.665099892Z

Affected Docker Images

Image Name SHA
public.ecr.aws/lambda/provided:latest public.ecr.aws/lambda/provided@sha256:ffb064eaa67922bd2a7d5bd4f878cc964206565260b929bf00daa361f1dfaa2c
public.ecr.aws/lambda/provided:al2023 public.ecr.aws/lambda/provided@sha256:ffb064eaa67922bd2a7d5bd4f878cc964206565260b929bf00daa361f1dfaa2c
public.ecr.aws/lambda/python:latest public.ecr.aws/lambda/python@sha256:c89171d819ca635d366a456b8bcc220567a586a19fc64e5859f6cd429d896f8d
public.ecr.aws/lambda/python:3.15-preview public.ecr.aws/lambda/python@sha256:d100342954d5ec3c76d4ecf217454a5a914e193aeb1ccb84c5def04ded7a5c58
public.ecr.aws/lambda/python:3.14 public.ecr.aws/lambda/python@sha256:c89171d819ca635d366a456b8bcc220567a586a19fc64e5859f6cd429d896f8d
public.ecr.aws/lambda/python:3.13 public.ecr.aws/lambda/python@sha256:682b47c63e6f1efb1d6fca5ff89433d9ee77490e2ee688331f6a102ef5870ccc
public.ecr.aws/lambda/python:3.12 public.ecr.aws/lambda/python@sha256:a32fd0af1505dad402a3a8c2bc1766a81b292f6869f13f1239d6c28b57b434c7
public.ecr.aws/lambda/nodejs:latest public.ecr.aws/lambda/nodejs@sha256:523ce8499e16c3bff599c94691e1c6a1405aac415c13b95b98dbb9dddd052b77
public.ecr.aws/lambda/nodejs:26-preview public.ecr.aws/lambda/nodejs@sha256:f5118e838e4efe4462b87cb77b1b255170952560a5766ad9c0d3f30016c57800
public.ecr.aws/lambda/nodejs:24 public.ecr.aws/lambda/nodejs@sha256:523ce8499e16c3bff599c94691e1c6a1405aac415c13b95b98dbb9dddd052b77
public.ecr.aws/lambda/nodejs:22 public.ecr.aws/lambda/nodejs@sha256:282bd7028e6d1f365a3a174751634c7a84e12ef8a466cdcf786c3f4d744e743a
public.ecr.aws/lambda/java:latest public.ecr.aws/lambda/java@sha256:3967a35b70fd6d23b36423490d42be284fce0ebf9185cb5a7885b013a2a1f30f
public.ecr.aws/lambda/java:25 public.ecr.aws/lambda/java@sha256:3967a35b70fd6d23b36423490d42be284fce0ebf9185cb5a7885b013a2a1f30f
public.ecr.aws/lambda/java:21 public.ecr.aws/lambda/java@sha256:71f263451adcf72867ff07a20fbe0f9b31d1057f9fbe439d24fd79105284fe40
public.ecr.aws/lambda/dotnet:latest public.ecr.aws/lambda/dotnet@sha256:5e30337d617e3e2e893a19e08230298811da782275e2103e6c88faec12f8001c
public.ecr.aws/lambda/dotnet:10 public.ecr.aws/lambda/dotnet@sha256:5e30337d617e3e2e893a19e08230298811da782275e2103e6c88faec12f8001c
public.ecr.aws/lambda/dotnet:9 public.ecr.aws/lambda/dotnet@sha256:fa35156bcae41dbcde11dfba48f44de95a1a204b4eee403a6890b13c9b0af61f
public.ecr.aws/lambda/dotnet:8 public.ecr.aws/lambda/dotnet@sha256:9ae9a50f02d9c8b741bf45cfc558deea09e9a0b147252f5f1db9d3d5340829f1
public.ecr.aws/lambda/ruby:latest public.ecr.aws/lambda/ruby@sha256:d03542289586d83ab29c1efc6f7d01b2701d0672d1c7ce0e4d5aac6e561fce92
public.ecr.aws/lambda/ruby:4.0 public.ecr.aws/lambda/ruby@sha256:d03542289586d83ab29c1efc6f7d01b2701d0672d1c7ce0e4d5aac6e561fce92
public.ecr.aws/lambda/ruby:3.4 public.ecr.aws/lambda/ruby@sha256:cc17551ba0f3570c59d15835caf482dde68b5de6cf42236b4504bce97f37f95e
public.ecr.aws/lambda/ruby:3.3 public.ecr.aws/lambda/ruby@sha256:30fd99152591e9f678db8489c30e931970c1c81dcdaffda4dfe584cb81d3b1c8

Description

In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.

Remediation Steps
  • Update the affected package pcre2 from version 10.40-1.amzn2023.0.3 to 10.40-1.amzn2023.0.4.
About this issue
  • This issue may not contain all the information about the CVE nor the images it affects.
  • This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
  • For more, visit Lambda Watchdog.
  • This issue was created automatically by Lambda Watchdog.
Lingua principale
Nessun dato sulla lingua
Stelle
775
Fork
117
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di aws/aws-lambda-base-images

Tutte le issue di aws/aws-lambda-base-images

Issue simili

Altre issue su Cloud

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.