Important: postgresql

Issue Overview: This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. Database owners have that right by default, and explicit grants may extend it to other users. CVE-2023-2454 While CVE-2016-2193 fixed most interaction between row...

Fixed in Apache Tomcat 10.1.19

Important: Denial of Service CVE-2024-23672 It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption. This was fixed with commit 0052b374. This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made publi...

Amazon Linux 2 : xorg-x11-server (ALAS-2024-2455)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2455 advisory. Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer NOTE: https://lists.x.org/archives/xorg/2024-January/061525.htmlNOTE:...

Amazon Linux 2 : unbound (ALAS-2024-2468)

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2468 advisory. NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the ghost domain names attack. Th...

Amazon Linux 2 : jetty (ALAS-2024-2460)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2460 advisory. Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the + character proceeding the content-length value in a HTTP/1 header field. Thi...

Amazon Linux 2 : webkitgtk4 (ALAS-2024-2459)

The version of webkitgtk4 installed on the remote host is prior to 2.42.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2459 advisory. 2024-04-11: CVE-2024-23252 was added to this advisory. A use-after-free issue was addressed with improved memory...

Amazon Linux 2 : xstream (ALAS-2024-2464)

The version of xstream installed on the remote host is prior to 1.3.1-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2464 advisory. Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user...

Medium: jtidy

Issue Overview: An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. CVE-2023-34623 Affected Packages: jtidy Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Vis...

Fixed in Apache Tomcat 9.0.86

Important: Denial of Service CVE-2024-23672 It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption. This was fixed with commit 52d6650e. This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made publi...

Fixed in Apache Tomcat 11.0.0-M17

Important: Denial of Service CVE-2024-23672 It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption. This was fixed with commit b0e3b1bd. This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made publi...

Amazon Linux 2 : nss-softokn (ALAS-2024-2456)

The version of nss-softokn installed on the remote host is prior to 3.90.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2456 advisory. Multiple NSS NIST curves were susceptible to a side-channel attack known as Minerva. This attack could potentially allow an...

Important: amazon-ssm-agent

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 A malicious HTTP sender can use chunk extensions to cause a receiver...

Important: amazon-ssm-agent

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 A malicious HTTP sender can use chunk extensions to cause a receiver...

Amazon Linux 2 : gstreamer1-plugins-bad-free (ALAS-2024-2454)

The version of gstreamer1-plugins-bad-free installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2454 advisory. GStreamer-SA-2024-0001: AV1 codec parser potential buffer overflow during tile list parsing NOTE:...

Medium: xstream

Issue Overview: Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

PT-2024-2570

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions prior to 11.0.0-M1, 10.1.0-M1, 9.0.0-M1, 8.5.0 through 8.5.98. Description The vulnerability in Apache Tomcat is due to improper input validation for HTTP/2 requests, leading to potential DoS conditions. If the request...

Medium: jtidy

Issue Overview: An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. CVE-2023-34623 Affected Packages: jtidy Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Vis...

Amazon Linux 2 : ghostscript (ALAS-2024-2469)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2469 advisory. Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c for txtwrite becaus...

Security Bulletin: IBM Match 360 is vulnerable to vulnerable to a denial of service due to HTTP/2 Rapid Reset within IBM WebSphere Application Server Liberty (CVE-2023-44487)

Summary IBM Match 360 is vulnerable to vulnerable to a denial of service due to HTTP/2 Rapid Reset within IBM WebSphere Application Server Liberty. Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling multiplexed streams in the HTTP/2 protocol. By sending numerous...

Ubuntu: Security Advisory (USN-6628-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...