Amazon Linux 1 Security Advisory: ALAS-2017-866
Advisory Release Date: 2017-08-03 19:21 Pacific
Advisory Updated Date: 2024-01-18 16:30 Pacific
FAQs regarding Amazon Linux ALAS/CVE Severity
2024-01-18: The invalid reference CVE-Pending was removed from this advisory.
A vulnerability was reported in the CloudFormation bootstrap tools, different from the one in CVE-2017-9450, where default behavior in the handling of cfn-init metadata can provide escalated privileges to an attacker with local access to the system
Affected Packages:
aws-cfn-bootstrap
Issue Correction:
- Run yum update aws-cfn-bootstrap to update your system.
- Update the AWS::CloudFormation::Init metadata section of your template, specifically the entries listed under the files key, to explicitly specify the mode field as documented at http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-init.html . We recommend setting the mode to explicitly disable permissions for non-owners. Alternatively, you can also choose to explicitly change the mode of the files listed in your template, by directly logging on to the instance.
- Restart the cfn-hup process: service cfn-hup restart
noarch:
aws-cfn-bootstrap-1.4-20.12.amzn1.noarch
src:
aws-cfn-bootstrap-1.4-20.12.amzn1.src