The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade yum-plugin-fastestmirrorUpgrade yum-updateonbootUpgrade yum-plugin-filter-dataUpgrade yum-plugin-upgrade-helperUpgrade yum-plugin-tsflagsUpgrade yum-plugin-ovlUpgrade yum-plugin-aliasesUpgrade yum-plugin-verifyUpgrade yum-utilsUpgrade yum-plugin-prioritiesUpgrade yum-plugin-coprUpgrade yum-plugin-keysUpgrade yum-plugin-auto-update-debug-infoUpgrade yum-plugin-fs-snapshotUpgrade yum-plugin-merge-confUpgrade yum-plugin-tmprepoUpgrade yum-NetworkManager-dispatcherUpgrade yum-plugin-post-transaction-actionsUpgrade yum-plugin-versionlockUpgrade yum-plugin-show-leavesUpgrade yum-plugin-pre-transaction-actionsUpgrade yum-plugin-rpm-warm-cacheUpgrade yum-plugin-remove-with-leavesUpgrade yum-plugin-localUpgrade yum-plugin-psUpgrade yum-plugin-changelogUpgrade yum-plugin-protectbaseUpgrade yum-plugin-list-data | Apr 27, 2020 | Aug 1, 2018 |
| Amazon_linux | — | Upgrade yum-utils | Aug 11, 2018 | Jul 30, 2018 |
| Centos_linux | — | Upgrade yum-plugin-tmprepoUpgrade yum-plugin-changelogUpgrade yum-plugin-upgrade-helperUpgrade yum-plugin-aliasesUpgrade yum-plugin-pre-transaction-actionsUpgrade yum-plugin-merge-confUpgrade yum-plugin-coprUpgrade yum-plugin-post-transaction-actionsUpgrade yum-plugin-rpm-warm-cacheUpgrade yum-plugin-localUpgrade yum-plugin-verifyUpgrade yum-plugin-prioritiesUpgrade yum-plugin-fs-snapshotUpgrade yum-plugin-protectbaseUpgrade yum-plugin-securityUpgrade yum-utilsUpgrade yum-updateonbootUpgrade yum-plugin-keysUpgrade yum-NetworkManager-dispatcherUpgrade yum-plugin-versionlockUpgrade yum-plugin-tsflagsUpgrade yum-plugin-ovlUpgrade yum-plugin-show-leavesUpgrade yum-plugin-auto-update-debug-infoUpgrade yum-plugin-fastestmirrorUpgrade yum-plugin-psUpgrade yum-plugin-list-dataUpgrade yum-plugin-remove-with-leavesUpgrade yum-plugin-filter-data | Aug 11, 2018 | Jul 30, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade yum-plugin-versionlockUpgrade yum-plugin-changelogUpgrade yum-plugin-verifyUpgrade yum-plugin-prioritiesUpgrade yum-utilsUpgrade yum-plugin-tmprepoUpgrade yum-plugin-aliases | Sep 27, 2018 | Aug 1, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade yum-utilsUpgrade yum-plugin-aliasesUpgrade yum-plugin-verifyUpgrade yum-plugin-prioritiesUpgrade yum-plugin-tmprepoUpgrade yum-plugin-versionlockUpgrade yum-plugin-changelog | Sep 27, 2018 | Aug 1, 2018 |
| Oracle_linux | — | Upgrade yum-plugin-pre-transaction-actionsUpgrade yum-plugin-merge-confUpgrade yum-plugin-verifyUpgrade yum-plugin-post-transaction-actionsUpgrade yum-plugin-tmprepoUpgrade yum-plugin-aliasesUpgrade yum-plugin-upgrade-helperUpgrade yum-plugin-rpm-warm-cacheUpgrade yum-plugin-fs-snapshotUpgrade yum-plugin-coprUpgrade yum-plugin-prioritiesUpgrade yum-plugin-localUpgrade yum-utilsUpgrade yum-updateonbootUpgrade yum-plugin-keysUpgrade yum-plugin-auto-update-debug-infoUpgrade yum-plugin-remove-with-leavesUpgrade yum-plugin-securityUpgrade yum-plugin-psUpgrade yum-plugin-changelogUpgrade yum-plugin-show-leavesUpgrade yum-plugin-ovlUpgrade yum-plugin-tsflagsUpgrade yum-plugin-filter-dataUpgrade yum-plugin-versionlockUpgrade yum-plugin-protectbaseUpgrade yum-plugin-list-dataUpgrade yum-plugin-fastestmirrorUpgrade yum-NetworkManager-dispatcher | Jul 31, 2018 | Jul 11, 2018 |
| Redhat_linux | — | Upgrade yum-plugin-prioritiesUpgrade yum-plugin-fs-snapshotUpgrade yum-plugin-rpm-warm-cacheUpgrade yum-plugin-changelogNo solution existsUpgrade yum-plugin-post-transaction-actionsUpgrade yum-plugin-localUpgrade yum-plugin-verifyUpgrade yum-plugin-filter-dataUpgrade yum-plugin-upgrade-helperUpgrade yum-plugin-aliasesUpgrade yum-plugin-pre-transaction-actionsUpgrade yum-plugin-tmprepoUpgrade yum-plugin-auto-update-debug-infoUpgrade yum-updateonbootUpgrade yum-utilsUpgrade yum-plugin-keysUpgrade yum-plugin-tsflagsUpgrade yum-plugin-remove-with-leavesUpgrade yum-plugin-versionlockUpgrade yum-NetworkManager-dispatcherUpgrade yum-plugin-protectbaseUpgrade yum-plugin-ovlUpgrade yum-plugin-merge-confUpgrade yum-plugin-fastestmirrorUpgrade yum-plugin-securityUpgrade yum-plugin-psUpgrade yum-plugin-coprUpgrade yum-plugin-list-dataUpgrade yum-plugin-show-leaves | Jul 31, 2018 | Jul 30, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub