[Cucumber-linux-security] grub (security update is available)

[Scott C. <sc...@cu...>]

  Update Information

A security update is available for grub for the following versions of
Cucumber Linux:

  * 1.0
  * 1.1

Here are the details from the Cucumber 1.1 changelog:

+----------------+
Fri Jun 1 15:29:33 EDT 2018
base/grub rebuilt (build 3) to fix CVE-2015-8370, a security vulnerability that
	allowed for escalation of privileges, information disclosure and/or a
	denial of service by a local attacker if Grub was configured to require
	a username and password (note that it is not configured this way by
	default).

	This update also adds a doinst.sh to the package, which will update the
	Grub modules in /boot/grub when the grub package is installed/updated.
	The modules will be updated if and only if the version of Grub
	installed to /boot is the same as the version of Grub installed in
	Cucumber Linux. For more information see:
		https://security.cucumberlinux.com/security/details.php?id=421
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8370
		http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html
* SECURITY FIX *
+----------------+

------------------------------------------------------------------------


  CLD and CVE Information

This update is associated with the following Cucumber Linux Deficiency
(CLD) and CVE numbers:

  * CLD-421 [CVE-2015-8370]
    (https://security.cucumberlinux.com/security/details.php?id=421)

More information about these CLDs can be found at their respective pages
on the Cucumber Linux Security Advisory Tracker (these are the URLs in
parenthesis above).

------------------------------------------------------------------------


  Installing the Update

The updated package can be installed via Pickle by running the following
commands (as root):

# pickle --update
# pickle

Make sure grub is selected on the update list, and then select Ok.
Pickle will then install the updated package.

If you prefer to download the updated package manually, it can be found
on the mirror at http://mirror.cucumberlinux.com/cucumber/.

------------------------------------------------------------------------
The Cucumber Linux Security Team
cuc...@li...
<mailto:cuc...@li...>
https://www.cucumberlinux.com/security.php