Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1113: Setup in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pam_shells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users which had their shell changed to /sbin/nologin could still access the system. 1571094: CVE-2018-1113 setup: nologin listed in /etc/shells violates security expectations
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | setup | 0:2.8.71-10.amzn2 |
Vulnerabilities 1
-
Medium 4.8
setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-1113.html