Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3816: Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server. 1667070: CVE-2019-3816 openwsman: Disclosure of arbitrary files outside of the registered URIs
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libwsman-devel | 0:2.6.3-6.git4391e5c.amzn2 |
| Amazon Linux · 2 | libwsman1 | 0:2.6.3-6.git4391e5c.amzn2 |
| Amazon Linux · 2 | openwsman-client | 0:2.6.3-6.git4391e5c.amzn2 |
| Amazon Linux · 2 | openwsman-debuginfo | 0:2.6.3-6.git4391e5c.amzn2 |
| Amazon Linux · 2 | openwsman-perl | 0:2.6.3-6.git4391e5c.amzn2 |
| Amazon Linux · 2 | openwsman-python | 0:2.6.3-6.git4391e5c.amzn2 |
| Amazon Linux · 2 | openwsman-ruby | 0:2.6.3-6.git4391e5c.amzn2 |
| Amazon Linux · 2 | openwsman-server | 0:2.6.3-6.git4391e5c.amzn2 |
Vulnerabilities 1
-
High 7.5CVE-2019-3816 EPSS 15%
Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working director…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-3816.html