Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-10897: A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. 1600221: CVE-2018-10897 yum-utils: reposync: improper path validation may lead to directory traversal
Fixed packages 28
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | yum-NetworkManager-dispatcher | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-aliases | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-auto-update-debug-info | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-changelog | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-copr | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-fastestmirror | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-filter-data | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-fs-snapshot | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-keys | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-list-data | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-local | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-merge-conf | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-ovl | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-post-transaction-actions | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-pre-transaction-actions | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-priorities | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-protectbase | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-ps | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-remove-with-leaves | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-rpm-warm-cache | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-show-leaves | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-tmprepo | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-tsflags | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-upgrade-helper | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-verify | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-plugin-versionlock | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-updateonboot | 0:1.1.31-46.amzn2.0.1 |
| Amazon Linux · 2 | yum-utils | 0:1.1.31-46.amzn2.0.1 |
Vulnerabilities 1
-
High 8.8
A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remot…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-10897.html