Skip to content
OpenAdvisories
Medium ALAS2-2018-1006 1 CVE

Moderate: PackageKit security update (Amazon Linux 2)

Published Apr 26, 2018 · Updated Apr 26, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1106: An authentication bypass flaw has been found in PackageKit that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system. 1565992: CVE-2018-1106 PackageKit: authentication bypass allows to install signed packages without administrator privileges

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 PackageKit 0:1.1.5-2.amzn2.0.1
Amazon Linux · 2 PackageKit-command-not-found 0:1.1.5-2.amzn2.0.1
Amazon Linux · 2 PackageKit-cron 0:1.1.5-2.amzn2.0.1
Amazon Linux · 2 PackageKit-debuginfo 0:1.1.5-2.amzn2.0.1
Amazon Linux · 2 PackageKit-glib 0:1.1.5-2.amzn2.0.1
Amazon Linux · 2 PackageKit-glib-devel 0:1.1.5-2.amzn2.0.1
Amazon Linux · 2 PackageKit-gstreamer-plugin 0:1.1.5-2.amzn2.0.1
Amazon Linux · 2 PackageKit-gtk3-module 0:1.1.5-2.amzn2.0.1
Amazon Linux · 2 PackageKit-yum 0:1.1.5-2.amzn2.0.1
Amazon Linux · 2 PackageKit-yum-plugin 0:1.1.5-2.amzn2.0.1

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-1106.html