Skip to content
OpenAdvisories
Medium ALAS2-2018-1123 1 CVE

Moderate: fuse security update (Amazon Linux 2)

Published Dec 6, 2018 · Updated Dec 8, 2018

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-10906: A vulnerability was discovered in fuse. When SELinux is active, fusermount is vulnerable to a restriction bypass. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects. 1602996: CVE-2018-10906 fuse: bypass of the "user_allow_other" restriction when SELinux is active

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 fuse 0:2.9.2-11.amzn2
Amazon Linux · 2 fuse-debuginfo 0:2.9.2-11.amzn2
Amazon Linux · 2 fuse-devel 0:2.9.2-11.amzn2
Amazon Linux · 2 fuse-libs 0:2.9.2-11.amzn2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-10906.html