Skip to content
OpenAdvisories
Low ALAS2-2019-1158 1 CVE

Low: setup security update (Amazon Linux 2)

Published Feb 13, 2019 · Updated Feb 14, 2019

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1113: Setup in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pam_shells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users which had their shell changed to /sbin/nologin could still access the system. 1571094: CVE-2018-1113 setup: nologin listed in /etc/shells violates security expectations

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2 setup 0:2.8.71-10.amzn2

Vulnerabilities 1

  • Medium 4.8

    setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to …

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-1113.html