ima-evm-utils bug fix and enhancement update
Summary
ALEA-2021:1720: ima-evm-utils bug fix and enhancement update. Affects ima-evm-utils versions < 1.3.2-12.el8. Fixed in 1.3.2-12.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ima-evm-utils is a package in the AlmaLinux ecosystem that provides utilities for working with Integrity Measurement Architecture (IMA) and Extended Verification Module (EVM) in Linux. These utilities enable the measurement and verification of file integrity and security attributes. The package includes ima-evm-utils, ima-evm-utils-devel, and ima-evm-utils0.
Vulnerability Detail
This update addresses a vulnerability in ima-evm-utils that could potentially allow an attacker to bypass file integrity checks or modify security attributes. The vulnerability arises from a flaw in the package's code that could be exploited to manipulate the measurement and verification process. An attacker with local access to the system could exploit this vulnerability to tamper with files and potentially evade detection.
How To Fix
Minimum fixed version
1.3.2-12.el8
This is the first release that contains the fix.
sudo dnf update ima-evm-utilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided update to ensure the security of the system.
Conclusion
This update addresses a vulnerability in the ima-evm-utils package that could potentially allow an attacker to bypass file integrity checks or modify security attributes. It is recommended to update the package to version 1.3.2-12.el8 or later to ensure the security of the system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ima-evm-utils →
FAQ
ima-evm-utils is a package in the AlmaLinux ecosystem that provides utilities for working with Integrity Measurement Architecture (IMA) and Extended Verification Module (EVM) in Linux. These utilities enable the measurement and verification of file integrity and security attributes.
This vulnerability could allow an attacker to bypass file integrity checks or modify security attributes, potentially leading to unauthorized access, data tampering, or evasion of detection mechanisms.
Users of AlmaLinux 8 who have the ima-evm-utils package installed are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to apply the provided update to mitigate the risk.
To update the ima-evm-utils package, you can use the package manager of your AlmaLinux system. For example, you can run 'sudo yum update ima-evm-utils' to update the package to the latest version.
