Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-15906: The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files. 1506630: CVE-2017-15906 openssh: Improper write operations in readonly mode allow for zero-length file creation
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | openssh | 0:7.4p1-16.amzn2.0.1 |
| Amazon Linux · 2 | openssh-askpass | 0:7.4p1-16.amzn2.0.1 |
| Amazon Linux · 2 | openssh-cavs | 0:7.4p1-16.amzn2.0.1 |
| Amazon Linux · 2 | openssh-clients | 0:7.4p1-16.amzn2.0.1 |
| Amazon Linux · 2 | openssh-debuginfo | 0:7.4p1-16.amzn2.0.1 |
| Amazon Linux · 2 | openssh-keycat | 0:7.4p1-16.amzn2.0.1 |
| Amazon Linux · 2 | openssh-ldap | 0:7.4p1-16.amzn2.0.1 |
| Amazon Linux · 2 | openssh-server | 0:7.4p1-16.amzn2.0.1 |
| Amazon Linux · 2 | openssh-server-sysvinit | 0:7.4p1-16.amzn2.0.1 |
| Amazon Linux · 2 | pam_ssh_agent_auth | 0:0.10.3-2.16.amzn2 |
Vulnerabilities 1
-
Medium 5.3
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2017-15906.html