Amazon Linux 2 : ImageMagick (ALAS-2023-2178)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2178 advisory. A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel function in quantum- private.h. This issue may...

Amazon Linux AMI : nghttp2 (ALAS-2023-1793)

The version of nghttp2 installed on the remote host is prior to 1.33.0-1.1.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1793 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

Amazon Linux 2023 : libnghttp2, libnghttp2-devel, nghttp2 (ALAS2023-2023-278)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-278 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY fram...

Amazon Linux 2 : cni-plugins (ALAS-2023-2192)

The version of cni-plugins installed on the remote host is prior to 1.2.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2192 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block...

Amazon Linux 2 : golang (ALAS-2023-2186)

The version of golang installed on the remote host is prior to 1.20.6-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2186 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-038)

The version of kernel installed on the remote host is prior to 5.10.186-179.751. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-038 advisory. 2024-07-03: CVE-2023-3389 was added to this advisory. 2023-08-31: CVE-2023-20569 was added to this...

Amazon Linux 2 : webkitgtk4 (ALAS-2023-2177)

The version of webkitgtk4 installed on the remote host is prior to 2.38.5-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2177 advisory. A vulnerability was found in webkitgtk. This issue occurs when processing web content, which may lead to arbitrary code...

Amazon Linux 2 : yajl (ALAS-2023-2182)

The version of yajl installed on the remote host is prior to 2.0.4-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2182 advisory. There's a memory leak in yajl 2.1.0 with use of yajltreeparse function. which will cause out-of-memory in server and cause crash...

Amazon Linux 2 : python-configobj (ALAS-2023-2188)

The version of python-configobj installed on the remote host is prior to 4.7.2-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2188 advisory. All versions of the package configobj are vulnerable to Regular Expression Denial of Service ReDoS via the validate...

Amazon Linux 2 : nghttp2 (ALAS-2023-2180)

The version of nghttp2 installed on the remote host is prior to 1.41.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2180 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

Amazon Linux 2 : cups (ALAS-2023-2184)

The version of cups installed on the remote host is prior to 1.6.3-51. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2184 advisory. OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a...

CVE-2023-39908

The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the length of specific read operations on object metadata. This may lead to disclosure of uninitialized and previously used memory...

CVE-2023-39908

CVE-2023-39908 affects the PKCS11 module of the YubiHSM 2 SDK (through 2023.01). The issue is an improper validation of the length in specific read operations on object metadata, which may disclose uninitialized and previously used memory. Connected Nessus and Red Hat/NVD entries corroborate an u...

Yubico YubiHSM 2 SDK Buffer Error Vulnerability

Yubico YubiHSM is a solution from Yubico Inc. for protecting Certificate Authority root keys from being copied by attackers, malware and malicious insiders. A security vulnerability exists in Yubico YubiHSM 2 SDK 2023.01 and earlier versions, which stems from the PKCS11 module failing to correctl...

CVE-2023-39908

The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the length of specific read operations on object metadata. This may lead to disclosure of uninitialized and previously used memory...

Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2023-005)

The version of java-11-openjdk installed on the remote host is prior to 11.0.20.0.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2JAVA-OPENJDK11-2023-005 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK...

Amazon Linux 2 : python-setuptools (ALAS-2023-2196)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2196 advisory. Python Packaging Authority PyPA setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denia...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-050)

The version of kernel installed on the remote host is prior to 5.4.250-166.369. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-050 advisory. An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to...

Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2023-025)

The version of runc installed on the remote host is prior to 1.1.7-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2023-025 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject...

Amazon Linux 2 : qemu (ALAS-2023-2191)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2191 advisory. There is a vulnerability in the lsi53c895a device which affects the latest version of qemu. The carefully designed PoC can repeatedly...