Amazon Linux 2023 : librsvg2, librsvg2-devel, librsvg2-tools (ALAS2023-2023-295)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-295 advisory. A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files on the local filesystem outside of the expected area, as demonstrat...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-304)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-304 advisory. The use of Module.load can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. Please note that at the time this CVE was issued, the policy...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2023-307)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-307 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fi...

Amazon Linux 2023 : runc (ALAS2023-2023-311)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-311 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2023-296)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-296 advisory. 2024-02-15: CVE-2020-21710 was added to this advisory. A divide by zero issue discovered in epsprintpage in gdevepsn.c in Artifex Software GhostScript 9.50 allows remote attackers to cause a...

Amazon Linux 2023 : doxygen2man, libqb, libqb-devel (ALAS2023-2023-294)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-294 advisory. logblackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered. CVE-2023-39976 Tenable has extracted the preceding description block directl...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-306)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-306 advisory. Issue summary: The AES-SIV cipher implementation contains a bug that causesit to ignore empty associated data entries which are unauthenticated asa consequence. Impact summary: Applications tha...

Amazon Linux 2023 : jsoup, jsoup-javadoc (ALAS2023-2023-315)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-315 advisory. jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting XSS safety. jsoup may incorrectly sanitize HTML including javascript: URL expressions, which could allow...

Amazon Linux 2023 : poppler, poppler-cpp, poppler-cpp-devel (ALAS2023-2023-289)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-289 advisory. Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder JBIG2Stream::readTextRegionSeg in JBIGStream.cc. Processing a specially crafted PDF file or JBIG2 image could lea...

Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2023-280)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-280 advisory. A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence o...

Amazon Linux 2023 : grpc, grpc-cpp, grpc-data (ALAS2023-2023-282)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-282 advisory. 2023-10-12: CVE-2023-4785 was added to this advisory. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-287)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-287 advisory. A Gather Data Sampling GDS transient execution side-channel vulnerability was found affecting certain Intel processors. This issue may allow a local attacker using gather instruction load from memory to...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-290)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-290 advisory. Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-285)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-285 advisory. 2023-08-31: CVE-2023-3611 was removed from this advisory. 2023-08-31: CVE-2023-3776 was removed from this advisory. 2023-08-31: The severity of this advisory was changed from important to mediu...

Amazon Linux 2023 : avahi, avahi-autoipd, avahi-compat-howl (ALAS2023-2023-272)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-272 advisory. A reachable assertion was found in avahidnspacketappendrecord. CVE-2023-38469 A reachable assertion was found in avahiescapelabel. CVE-2023-38470 A reachable assertion was found in...

Amazon Linux 2023 : python3-mako (ALAS2023-2023-288)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-288 advisory. Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin. CVE-2022-40023 Tenable has extract...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2023-291)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-291 advisory. A heap-based buffer overflow flaw was found in Redis. This flaw allows an attacker to trick an authenticated user into executing a specially crafted Lua script in Redis. This attack triggers a heap...

Amazon Linux 2023 : libnghttp2, libnghttp2-devel, nghttp2 (ALAS2023-2023-278)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-278 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY fram...

Amazon Linux 2023 : docker (ALAS2023-2023-260)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-260 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has no...

Amazon Linux 2023 : jackson-core (ALAS2023-2023-248)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-248 advisory. An issue was discovered jackson-databind thru 2.15.2 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. CVE-2023-35116 Tenable h...