Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-10906: A vulnerability was discovered in fuse. When SELinux is active, fusermount is vulnerable to a restriction bypass. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects. 1602996: CVE-2018-10906 fuse: bypass of the "user_allow_other" restriction when SELinux is active
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | fuse | 0:2.9.2-11.amzn2 |
| Amazon Linux · 2 | fuse-debuginfo | 0:2.9.2-11.amzn2 |
| Amazon Linux · 2 | fuse-devel | 0:2.9.2-11.amzn2 |
| Amazon Linux · 2 | fuse-libs | 0:2.9.2-11.amzn2 |
Vulnerabilities 1
-
Medium 5.3CVE-2018-10906 Public exploit
In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is ac…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-10906.html