Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-19044: keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protected_symlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd. 99999: CVE-2018-19044 keepalived: Improper pathname validation allows for overwrite of arbitrary filenames via symlinks
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | keepalived | 0:1.3.5-16.amzn2 |
| Amazon Linux · 2 | keepalived-debuginfo | 0:1.3.5-16.amzn2 |
Vulnerabilities 1
-
Unscored —
keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintDat…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-19044.html