Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1063: Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). 1550122: CVE-2018-1063 policycoreutils: Relabelling of symbolic links in /tmp and /var/tmp change the context of their target instead
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | policycoreutils | 0:2.5-22.amzn2 |
| Amazon Linux · 2 | policycoreutils-debuginfo | 0:2.5-22.amzn2 |
| Amazon Linux · 2 | policycoreutils-devel | 0:2.5-22.amzn2 |
| Amazon Linux · 2 | policycoreutils-gui | 0:2.5-22.amzn2 |
| Amazon Linux · 2 | policycoreutils-newrole | 0:2.5-22.amzn2 |
| Amazon Linux · 2 | policycoreutils-python | 0:2.5-22.amzn2 |
| Amazon Linux · 2 | policycoreutils-restorecond | 0:2.5-22.amzn2 |
| Amazon Linux · 2 | policycoreutils-sandbox | 0:2.5-22.amzn2 |
Vulnerabilities 1
-
Unscored —
Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entit…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-1063.html