High ALAS2023-2024-722 1 CVE

Important: oath-toolkit security update (Amazon Linux 2023)

Published Oct 10, 2024 · Updated Oct 14, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-47191: oath-toolkit: Local root exploit in a PAM module

Fixed packages 16

Release	Package	Fixed in
Amazon Linux · 2023	liboath	0:2.6.12-1.amzn2023.0.1
Amazon Linux · 2023	liboath-debuginfo	0:2.6.12-1.amzn2023.0.1
Amazon Linux · 2023	liboath-devel	0:2.6.12-1.amzn2023.0.1
Amazon Linux · 2023	liboath-doc	0:2.6.12-1.amzn2023.0.1
Amazon Linux · 2023	libpskc	0:2.6.12-1.amzn2023.0.1
Amazon Linux · 2023	libpskc-debuginfo	0:2.6.12-1.amzn2023.0.1
Amazon Linux · 2023	libpskc-devel	0:2.6.12-1.amzn2023.0.1
Amazon Linux · 2023	libpskc-doc	0:2.6.12-1.amzn2023.0.1
Amazon Linux · 2023	oath-toolkit-debuginfo	0:2.6.12-1.amzn2023.0.1
Amazon Linux · 2023	oath-toolkit-debugsource	0:2.6.12-1.amzn2023.0.1
Amazon Linux · 2023	oathtool	0:2.6.12-1.amzn2023.0.1
Amazon Linux · 2023	oathtool-debuginfo	0:2.6.12-1.amzn2023.0.1
Amazon Linux · 2023	pam_oath	0:2.6.12-1.amzn2023.0.1
Amazon Linux · 2023	pam_oath-debuginfo	0:2.6.12-1.amzn2023.0.1
Amazon Linux · 2023	pskctool	0:2.6.12-1.amzn2023.0.1
Amazon Linux · 2023	pskctool-debuginfo	0:2.6.12-1.amzn2023.0.1

Vulnerabilities 1

High 7.1

CVE-2024-47191

pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context…

oath-toolkit oath-toolkit oath-toolkit Debian Ubuntu Azure Linux

Oct 9, 2024

References

web
https://alas.aws.amazon.com/cve/html/CVE-2024-47191.html