Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-6133: A vulnerability was found in polkit. When authentication is performed by a non-root user to perform an administrative task, the authentication is temporarily cached in such a way that a local attacker could impersonate the authorized process, thus gaining access to elevated privileges. 1664212: CVE-2019-6133 polkit: Temporary auth hijacking via PID reuse and non-atomic fork
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | polkit | 0:0.112-18.amzn2.1 |
| Amazon Linux · 2 | polkit-debuginfo | 0:0.112-18.amzn2.1 |
| Amazon Linux · 2 | polkit-devel | 0:0.112-18.amzn2.1 |
| Amazon Linux · 2 | polkit-docs | 0:0.112-18.amzn2.1 |
Vulnerabilities 1
-
Unscored —
In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, an…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-6133.html