Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-7738: A command injection flaw was found in the way util-linux implements umount autocompletion in Bash. An attacker with the ability to mount a filesystem with custom mount points may execute arbitrary commands on behalf of the user who triggers the umount autocompletion.
Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libblkid | 0:2.30.2-2.amzn2.0.9 |
| Amazon Linux · 2 | libblkid-devel | 0:2.30.2-2.amzn2.0.9 |
| Amazon Linux · 2 | libfdisk | 0:2.30.2-2.amzn2.0.9 |
| Amazon Linux · 2 | libfdisk-devel | 0:2.30.2-2.amzn2.0.9 |
| Amazon Linux · 2 | libmount | 0:2.30.2-2.amzn2.0.9 |
| Amazon Linux · 2 | libmount-devel | 0:2.30.2-2.amzn2.0.9 |
| Amazon Linux · 2 | libsmartcols | 0:2.30.2-2.amzn2.0.9 |
| Amazon Linux · 2 | libsmartcols-devel | 0:2.30.2-2.amzn2.0.9 |
| Amazon Linux · 2 | libuuid | 0:2.30.2-2.amzn2.0.9 |
| Amazon Linux · 2 | libuuid-devel | 0:2.30.2-2.amzn2.0.9 |
| Amazon Linux · 2 | python-libmount | 0:2.30.2-2.amzn2.0.9 |
| Amazon Linux · 2 | util-linux | 0:2.30.2-2.amzn2.0.9 |
| Amazon Linux · 2 | util-linux-debuginfo | 0:2.30.2-2.amzn2.0.9 |
| Amazon Linux · 2 | util-linux-user | 0:2.30.2-2.amzn2.0.9 |
| Amazon Linux · 2 | uuidd | 0:2.30.2-2.amzn2.0.9 |
Vulnerabilities 1
-
Unscored —
In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-7738.html