Amazon Linux AMI : python36 (ALAS-2020-1428)

The version of python36 installed on the remote host is prior to 3.6.11-1.18. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1428 advisory. In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when...

Amazon Linux AMI : golang (ALAS-2020-1417)

The version of golang installed on the remote host is prior to 1.13.14-1.58. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1417 advisory. Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProx...

Amazon Linux AMI : python-httplib2 (ALAS-2020-1420)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1420 advisory. In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for httplib2.Http.request could change request headers and body, send additional hidden requests to same server. This...

Amazon Linux AMI : ruby19, ruby21 (ALAS-2020-1426)

The version of ruby19 installed on the remote host is prior to 1.9.3.551-33.71. The version of ruby21 installed on the remote host is prior to 2.1.9-1.23. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1426 advisory. The JSON gem through 2.2.0 for Ruby, as used in Ru...

Amazon Linux AMI : ruby24 (ALAS-2020-1422)

The version of ruby24 installed on the remote host is prior to 2.4.10-2.12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1422 advisory. Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using...

Researchers Sound Alarm Over Malicious AWS Community AMIs

Researchers are sounding the alarm over what they say is a growing threat vector tied to Amazon Web Services and its marketplace of pre-configured virtual servers. The danger, according to researchers with Mitiga, is that threat actors can easily build malware-laced Community Amazon Machine Image...

Amazon Linux AMI : ruby20 (ALAS-2020-1416)

The version of ruby20 installed on the remote host is prior to 2.0.0.648-1.33. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1416 advisory. An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3...

Amazon Linux AMI : nghttp2 (ALAS-2020-1404)

The version of nghttp2 installed on the remote host is prior to 1.33.0-1.1.6. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1404 advisory. In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept...

Amazon Linux AMI : git (ALAS-2020-1413)

The version of git installed on the remote host is prior to 2.18.4-2.71. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1413 advisory. Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host...

Amazon Linux AMI : tomcat8 (ALAS-2020-1409)

The version of tomcat8 installed on the remote host is prior to 8.5.57-1.85. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1409 advisory. The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 t...

Amazon Linux AMI : qemu-kvm (ALAS-2020-1408)

The version of qemu-kvm installed on the remote host is prior to 1.5.3-156.19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1408 advisory. tcpemu in slirp/tcpsubr.c aka slirp/src/tcpsubr.c in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading ...

Amazon Linux AMI : python27, python34, python35, python36 (ALAS-2020-1407)

The version of python27 installed on the remote host is prior to 2.7.18-1.138. The version of python34 installed on the remote host is prior to 3.4.10-1.50. The version of python35 installed on the remote host is prior to 3.5.7-1.26. The version of python36 installed on the remote host is prior t...

Amazon Linux AMI : curl (ALAS-2020-1411)

The version of curl installed on the remote host is prior to 7.61.1-12.94. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1411 advisory. This issue only affects the 'curl' command line utility. Additionally, this is only an issue when using the '-J' with the '-O'...

Amazon Linux AMI : librabbitmq (ALAS-2020-1394)

The version of librabbitmq installed on the remote host is prior to 0.1-0.2.hgfb6fca832fd2.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1394 advisory. An issue was discovered in amqphandleinput in amqpconnection.c in rabbitmq-c 0.9.0. There is an integer overflo...

Amazon Linux AMI : php72, php73 (ALAS-2020-1397)

The version of php72 installed on the remote host is prior to 7.2.31-1.23. The version of php73 installed on the remote host is prior to 7.3.19-1.26. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1397 advisory. In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18...

Amazon Linux AMI : kernel (ALAS-2020-1382)

The version of kernel installed on the remote host is prior to 4.14.177-107.254. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1382 advisory. A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw...

Amazon Linux AMI : mailman (ALAS-2020-1395)

The version of mailman installed on the remote host is prior to 2.1.15-30.25. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1395 advisory. Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject...

Amazon Linux AMI : transmission (ALAS-2020-1399)

The version of transmission installed on the remote host is prior to 3.00-1.1. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1399 advisory. Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service...

Amazon Linux AMI : cairo (ALAS-2020-1392)

The version of cairo installed on the remote host is prior to 1.12.14-6.9. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1392 advisory. The fillxrgb32lerpopaquespans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denia...

Amazon Linux AMI : poppler (ALAS-2020-1398)

The version of poppler installed on the remote host is prior to 0.26.5-42.20. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1398 advisory. The tiffdocumentrender and tiffdocumentgetthumbnail functions in the TIFF document backend in GNOME Evince through...