Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-13936: A flaw was found in velocity. An attacker, able to modify Velocity templates, may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 1937440: CVE-2020-13936 velocity: arbitrary code execution when attacker is able to modify templates
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | velocity | 0:1.7-10.2.amzn2 |
| Amazon Linux · 2 | velocity-demo | 0:1.7-10.2.amzn2 |
| Amazon Linux · 2 | velocity-javadoc | 0:1.7-10.2.amzn2 |
| Amazon Linux · 2 | velocity-manual | 0:1.7-10.2.amzn2 |
Vulnerabilities 1
-
High 8.8CVE-2020-13936 EPSS 23%
Velocity Sandbox Bypass
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/mod…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-13936.html