AWS CLI version 2.24.4 is vulnerable to CVE-2024-12254

[pafrank-mcd]

Describe the bug

The latest aws cli v2 (2.24.4) is vulnerable to CVE-2024-12254.
The distribution contains Python 3.12 which is vulnerable and needs to be upgraded to a higher version 3.12.9
https://alas.aws.amazon.com/AL2023/ALAS-2025-808.html

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

The package should not be vulnerable.

Current Behavior

Vulnerability scan result:
Vulnerability found in non-os package type (binary) - /usr/local/aws-cli/v2/2.24.2/dist/libpython3.12.so.1.0 (fixed in: 3.12.9, 3.13.2, 3.14.0a3)(CVE-2024-12254 - https://nvd.nist.gov/vuln/detail/CVE-2024-12254)

Reproduction Steps

Install latest aws cli v2 on Amazon Linux public.ecr.aws/amazonlinux/amazonlinux:2023.6.20250128.0
Run the anchore scanner which will flag this as a "High" vulnerability

Possible Solution

Update the python distribution to 3.12.9

Additional Information/Context

No response

CLI version used

2.24.4

Environment details (OS name and version, etc.)

Amazon linux based container(2023.6.20250128.0)

[RyanFitzSimmonsAK]

Hi @pafrank-mcd, thanks for reaching out. AWS CLI is not impacted by CVE-2024-12254, and no action is required to mitigate it. We intend to update the bundled Python interpreter in the near future, which will resolve these scanner alerts.