Skip to content
OpenAdvisories
Medium ALAS2-2020-1503 1 CVE

Moderate: bash security update (Amazon Linux 2)

Published Oct 22, 2020 · Updated Oct 22, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9924: rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell. 1691774: CVE-2019-9924 bash: BASH_CMD is writable in restricted bash shells

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 bash 0:4.2.46-34.amzn2
Amazon Linux · 2 bash-debuginfo 0:4.2.46-34.amzn2
Amazon Linux · 2 bash-doc 0:4.2.46-34.amzn2

Vulnerabilities 1

  • Unscored —
    CVE-2019-9924

    rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execu…

    bash bash Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-9924.html