Amazon Linux 2023 : nerdctl (ALAS2023-2025-1075)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1075 advisory. Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which a...

Amazon Linux 2023 : cloud-init, cloud-init-cfg-ec2, cloud-init-cfg-onprem (ALAS2023-2025-1082)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1082 advisory. When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2025-1058)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1058 advisory. urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disab...

Important: sudo

Issue Overview: Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines. CVE-2025-32462 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.co...

Low: python-pip

Issue Overview: No CVE associated with this advisory Affected Packages: python-pip Issue Correction: Run dnf update python-pip --releasever 2023.8.20250707 or dnf update --advisory ALAS2023-2025-1058 --releasever 2023.8.20250707 to update your system. More information on how to update your system...

Medium: docker

Issue Overview: Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. CVE-2025-22874 Proxy-Authorization and Proxy-Authenticate headers...

Amazon Linux 2023 : bpftool, kernel6.12, kernel6.12-modules-extra (ALAS2023-2025-1053)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1053 advisory. In the Linux kernel, the following vulnerability has been resolved: netsched: Flush gsoskb list too during -change CVE-2025-37992 In the Linux kernel, the following vulnerability has been...

Medium: nerdctl

Issue Overview: Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. CVE-2025-22874 Proxy-Authorization and Proxy-Authenticate headers...

Amazon Linux 2023 : valkey, valkey-devel (ALAS2023-2025-1067)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1067 advisory. Redis and Valkey contain a defect such that a well constructed hyperloglog can corrupt arbitrary memory on the heap, which could lead to remote code execution. CVE-2025-32023 Redis and Valkey...

Amazon Linux 2023 : bpftool, kernel6.12, kernel6.12-modules-extra (ALAS2023-2025-1080)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1080 advisory. In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix out-of-range access of vnicinfo array CVE-2025-22112 In the Linux kernel, the following vulnerability has bee...

Important: perl-File-Find-Rule

Issue Overview: File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when grep encounters a crafted filename. A file handle is opened with the 2 argument form of open allowing an attacker controlled filename to provide the MODE parameter to open, turning the filename...

Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2025-1034)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1034 advisory. A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct,...

Amazon Linux 2023 : openssh, openssh-clients, openssh-keycat (ALAS2023-2025-1038)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1038 advisory. In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding. CVE-2025-32728 Tenable has extracted the precedin...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1037)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1037 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: check folio mapping after unlock in relocateonefolio CVE-2024-56758 In the Linux kernel, the following vulnerability...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2025-1044)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1044 advisory. Allows modifying some file metadata e.g. last modified with filter=data or file permissions chmod with filter=tar of files outside the extraction directory.You are affected by this vulnerabili...

Amazon Linux 2023 : libxml2, libxml2-devel, libxml2-static (ALAS2023-2025-1019)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1019 advisory. A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a deni...

Amazon Linux 2023 : valkey, valkey-devel (ALAS2023-2025-1025)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1025 advisory. setDeferredReply in networking.c in Valkey through 8.1.1 has an integer underflow for prev-size - prev-used. CVE-2025-49112 Tenable has extracted the preceding description block directly from the teste...

Amazon Linux 2023 : libudisks2, libudisks2-devel, udisks2 (ALAS2023-2025-1021)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1021 advisory. LPE from allowactive to root in libblockdev via udisks CVE-2025-6019 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not...

Amazon Linux 2023 : libblockdev, libblockdev-crypto, libblockdev-crypto-devel (ALAS2023-2025-1020)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1020 advisory. LPE from allowactive to root in libblockdev via udisks CVE-2025-6019 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not...

Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2025-1039)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1039 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly...