Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3696: A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local user pcp to overwrite arbitrary files with arbitrary content. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise High Performance Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15-SP1 pcp versions prior to 4.3.1-3.5.3. SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server for SAP 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Software Development Kit 12-SP4 pcp versions prior to 3.11.9-6.14.1. SUSE Linux Enterprise Software Development Kit 12-SP5 pcp versions prior to 3.11.9-6.14.1. openSUSE Leap 15.1 pcp versions prior to 4.3.1-lp151.2.3.1. 1811707: CVE-2019-3696 pcp: Local privilege escalation in pcp spec file through migrate_tempdirs CVE-2019-3695: A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows the user pcp to run code as root by placing it into /var/log/pcp/configs.sh This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise High Performance Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15-SP1 pcp versions prior to 4.3.1-3.5.3. SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server for SAP 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Software Development Kit 12-SP4 pcp versions prior to 3.11.9-6.14.1. SUSE Linux Enterprise Software Development Kit 12-SP5 pcp versions prior to 3.11.9-6.14.1. openSUSE Leap 15.1 pcp versions prior to 4.3.1-lp151.2.3.1. 1811703: CVE-2019-3695 pcp: Local privilege escalation in pcp spec file %post section
Fixed packages 98
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | pcp | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-conf | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-debuginfo | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-devel | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-doc | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-export-pcp2elasticsearch | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-export-pcp2graphite | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-export-pcp2influxdb | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-export-pcp2json | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-export-pcp2spark | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-export-pcp2xml | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-export-pcp2zabbix | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-export-zabbix-agent | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-gui | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-import-collectl2pcp | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-import-ganglia2pcp | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-import-iostat2pcp | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-import-mrtg2pcp | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-import-sar2pcp | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-libs | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-libs-devel | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-manager | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-activemq | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-apache | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-bash | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-bind2 | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-bonding | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-cifs | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-cisco | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-dbping | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-dm | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-docker | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-ds389 | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-ds389log | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-elasticsearch | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-gfs2 | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-gluster | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-gpfs | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-gpsd | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-haproxy | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-infiniband | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-json | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-libvirt | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-lio | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-lmsensors | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-logger | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-lustre | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-lustrecomm | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-mailq | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-memcache | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-mic | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-mounts | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-mysql | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-named | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-netfilter | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-news | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-nfsclient | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-nginx | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-nvidia-gpu | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-oracle | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-pdns | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-perfevent | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-postfix | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-postgresql | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-prometheus | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-redis | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-roomtemp | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-rpm | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-rsyslog | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-samba | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-sendmail | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-shping | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-slurm | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-smart | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-snmp | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-summary | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-systemd | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-trace | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-unbound | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-vmware | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-weblog | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-zimbra | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-pmda-zswap | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-selinux | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-system-tools | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-testsuite | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-webapi | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-webapp-blinkenlights | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-webapp-grafana | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-webapp-graphite | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-webapp-vector | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-webjs | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | pcp-zeroconf | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | perl-PCP-LogImport | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | perl-PCP-LogSummary | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | perl-PCP-MMV | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | perl-PCP-PMDA | 0:4.3.2-12.amzn2.0.1 |
| Amazon Linux · 2 | python-pcp | 0:4.3.2-12.amzn2.0.1 |
Vulnerabilities 2
-
High 8.4
pcp: Local privilege escalation from user pcp to root
A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE …
-
High 8.4
pcp: Local privilege escalation from user pcp to root through migrate_tempdirs
A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Develo…