Amazon Linux 2 : java-17-amazon-corretto (ALAS-2024-2600)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.12+7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2600 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-075)

The version of kernel installed on the remote host is prior to 5.4.278-191.377. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2024-075 advisory. In the Linux kernel, the following vulnerability has been resolved: net: fix dstnegativeadvice race CVE-2024-36971...

Amazon Linux 2 : krb5 (ALAS-2024-2595)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2595 advisory. krb5: GSS message token handling CVE-2024-37370 In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens wi...

Amazon Linux 2 : ecs-init, --advisory ALAS2ECS-2024-039 (ALASECS-2024-039)

The version of ecs-init installed on the remote host is prior to 1.84.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-039 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of...

Ubuntu 16.04 LTS / 18.04 LTS : HAProxy vulnerability (USN-6530-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6530-2 advisory. Seth Manesse and Paul Plasil discovered that HAProxy incorrectly handled URI components containing the hash character . A remote attacker could possib...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-038)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.29.6.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2024-038 advisory. dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context du...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-064)

The version of kernel installed on the remote host is prior to 5.10.220-209.867. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-064 advisory. 2024-12-05: CVE-2022-48827 was added to this advisory. 2024-12-05: CVE-2022-48828 was added to this...

Amazon Linux 2 : nano (ALAS-2024-2590)

The version of nano installed on the remote host is prior to 2.9.8-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2590 advisory. nano: running chmod and chown on the filename allows malicious user to replace the emergency file with a malicious symlink to a...

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2024-013)

The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0422.b05-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2CORRETTO8-2024-013 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise...

Amazon Linux 2 : golang (ALAS-2024-2598)

The version of golang installed on the remote host is prior to 1.22.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2598 advisory. The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an Expect: 100-continue header with a...

Amazon Linux 2 : libreswan (ALAS-2024-2596)

The version of libreswan installed on the remote host is prior to 3.25-4.8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2596 advisory. The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. Wh...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-045)

The version of kernel installed on the remote host is prior to 5.15.161-106.159. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.15-2024-045 advisory. In the Linux kernel, the following vulnerability has been resolved: net: fix dstnegativeadvice race CVE-2024-3697...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2024-2599)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.24+8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2599 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product...

Amazon Linux 2 : mariadb (ALASMARIADB10.5-2024-006)

The version of mariadb installed on the remote host is prior to 10.5.25-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2MARIADB10.5-2024-006 advisory. MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11....

Amazon Linux 2 : gstreamer-plugins-base (ALAS-2024-2593)

The version of gstreamer-plugins-base installed on the remote host is prior to 0.10.36-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2593 advisory. GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows...

Amazon Linux 2 : ghostscript (ALAS-2024-2597)

The version of ghostscript installed on the remote host is prior to 9.54.0-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2597 advisory. NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.htmlNOTE: https://cgit.ghostscript.com/cgi-...

Amazon Linux 2 : gstreamer1-plugins-base (ALAS-2024-2592)

The version of gstreamer1-plugins-base installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2592 advisory. GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows...

CVE-2021-4160 affecting package edk2 for versions less than 20240223gitedc6681206c1-2

CVE-2021-4160 affecting package edk2 for versions less than 20240223gitedc6681206c1-2. An upgraded version of the package is available that resolves this issue...

CVE-2022-21698 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.2-2

CVE-2022-21698 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.2-2. A patched version of the package is available...

CVE-2024-24786 affecting package vitess for versions less than 19.0.4-2

CVE-2024-24786 affecting package vitess for versions less than 19.0.4-2. An upgraded version of the package is available that resolves this issue...