0

I am researching about the security hole CVE-2018-12020 and learned that you need to update to min version 2.2.8 to fix the issue.

I need to fix this for my EC2. I read information from this offical AWS report, and it says that the security hole will be fixed after I run yum update gnupg gnupg2.

In new packages session:

i686:
    gnupg-1.4.19-1.29.amzn1.i686
    gnupg-debuginfo-1.4.19-1.29.amzn1.i686
    gnupg2-smime-2.0.28-2.32.amzn1.i686
    gnupg2-debuginfo-2.0.28-2.32.amzn1.i686
    gnupg2-2.0.28-2.32.amzn1.i686

src:
    gnupg-1.4.19-1.29.amzn1.src
    gnupg2-2.0.28-2.32.amzn1.src

x86_64:
    gnupg-1.4.19-1.29.amzn1.x86_64
    gnupg-debuginfo-1.4.19-1.29.amzn1.x86_64
    gnupg2-smime-2.0.28-2.32.amzn1.x86_64
    gnupg2-debuginfo-2.0.28-2.32.amzn1.x86_64
    gnupg2-2.0.28-2.32.amzn1.x86_64

Why does AWS only show as version in 2.0.28, despite of the first claim that the security hole will only be fixed when you update to 2.2.8? This confuses me.

Is it a package before (was affected by this bug) or after you update (AWS fixed for this bug)?

| improve this question | | | | |
2

The confusion you are facing is that Amazon & RedHat back port fixes into their known stable branch, this is to say that

gnupg2-2.0.28-2.32

Really indicates gnupg2 core version 2.0.28 with revisions 2.32;

If I am understanding your question correctly, you should run: rpm -q gnupg2-2.0.28-2.32 --changelog and inspect the changelog to ensure the installed version contains the backported fix for CVE-2018-12020

| improve this answer | | | | |
  • 1
    after i check by your recommendation : rpm -q gnupg2-2.0.28-2.33.amzn1.x86_64 --changelog |grep "CVE-2018-12020" - Apply patch for CVE-2018-9234 & CVE-2018-12020 I see that this package include the fixing for the bug. Thank you so much. – Sơn Lâm Oct 10 '18 at 10:27
  • 1
    aws maintains the package by themself so I think this is a reason why the have a diffrent tag version. – Sơn Lâm Oct 10 '18 at 10:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.