Skip to content
OpenAdvisories
Low ALAS2-2018-1076 1 CVE

Low: policycoreutils security update (Amazon Linux 2)

Published Sep 12, 2018 · Updated Sep 15, 2018

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1063: Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). 1550122: CVE-2018-1063 policycoreutils: Relabelling of symbolic links in /tmp and /var/tmp change the context of their target instead

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 policycoreutils 0:2.5-22.amzn2
Amazon Linux · 2 policycoreutils-debuginfo 0:2.5-22.amzn2
Amazon Linux · 2 policycoreutils-devel 0:2.5-22.amzn2
Amazon Linux · 2 policycoreutils-gui 0:2.5-22.amzn2
Amazon Linux · 2 policycoreutils-newrole 0:2.5-22.amzn2
Amazon Linux · 2 policycoreutils-python 0:2.5-22.amzn2
Amazon Linux · 2 policycoreutils-restorecond 0:2.5-22.amzn2
Amazon Linux · 2 policycoreutils-sandbox 0:2.5-22.amzn2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-1063.html