Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-13313: A flaw was found in libosinfo, version 1.5.0, where the script for automated guest installations, 'osinfo-install-script', accepts user and admin passwords via command line arguments. This could allow guest passwords to leak to other system users via a process listing. 1727766: CVE-2019-13313 Libosinfo: osinfo-install-script option leaks password via command line argument
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libosinfo | 0:1.1.0-5.amzn2 |
| Amazon Linux · 2 | libosinfo-debuginfo | 0:1.1.0-5.amzn2 |
| Amazon Linux · 2 | libosinfo-devel | 0:1.1.0-5.amzn2 |
| Amazon Linux · 2 | libosinfo-vala | 0:1.1.0-5.amzn2 |
Vulnerabilities 1
-
Unscored —
libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osin…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-13313.html