I am researching about the security hole CVE-2018-12020 and learned that you need to update to min version 2.2.8 to fix the issue.
I need to fix this for my EC2. I read information from this offical AWS report, and it says that the security hole will be fixed after I run
yum update gnupg gnupg2.
In new packages session:
i686: gnupg-1.4.19-1.29.amzn1.i686 gnupg-debuginfo-1.4.19-1.29.amzn1.i686 gnupg2-smime-2.0.28-2.32.amzn1.i686 gnupg2-debuginfo-2.0.28-2.32.amzn1.i686 gnupg2-2.0.28-2.32.amzn1.i686 src: gnupg-1.4.19-1.29.amzn1.src gnupg2-2.0.28-2.32.amzn1.src x86_64: gnupg-1.4.19-1.29.amzn1.x86_64 gnupg-debuginfo-1.4.19-1.29.amzn1.x86_64 gnupg2-smime-2.0.28-2.32.amzn1.x86_64 gnupg2-debuginfo-2.0.28-2.32.amzn1.x86_64 gnupg2-2.0.28-2.32.amzn1.x86_64
Why does AWS only show as version in 2.0.28, despite of the first claim that the security hole will only be fixed when you update to 2.2.8? This confuses me.
Is it a package before (was affected by this bug) or after you update (AWS fixed for this bug)?