The version of unzip installed on the remote host is prior to 6.0-57. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1906 advisory.

  - A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can     lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file,     leading to a crash or code execution. (CVE-2021-4217)

  - A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local     string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially     crafted zip file, leading to a crash or code execution. (CVE-2022-0529, CVE-2022-0530)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Amazon Linux 2 : unzip (ALAS-2023-1906)

medium Nessus Plugin ID 170441

Version 1.0