Skip to content
OpenAdvisories
Critical ALAS2-2018-1021 1 CVE

Critical: dhcp security update (Amazon Linux 2)

Published May 24, 2018 · Updated May 29, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1111: A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Amazon Linux 2. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. 1567974: CVE-2018-1111 dhcp: Command injection vulnerability in the DHCP client NetworkManager integration script

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 dhclient 12:4.2.5-68.amzn2.1.2
Amazon Linux · 2 dhcp 12:4.2.5-68.amzn2.1.2
Amazon Linux · 2 dhcp-common 12:4.2.5-68.amzn2.1.2
Amazon Linux · 2 dhcp-debuginfo 12:4.2.5-68.amzn2.1.2
Amazon Linux · 2 dhcp-devel 12:4.2.5-68.amzn2.1.2
Amazon Linux · 2 dhcp-libs 12:4.2.5-68.amzn2.1.2

Vulnerabilities 1

  • High 7.5
    CVE-2018-1111 Public exploit EPSS 98%

    DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in…

    Red Hat Fedora dhcp dhcp

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-1111.html