Medium: python-pip

Issue Overview: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Affected Packages: python-pip Issue Correction: Run dnf update python-pip --releasever 2023.6.20241111 to update your system. New Packages: noarch: ...

Medium: python3.11-pip

Issue Overview: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Affected Packages: python3.11-pip Issue Correction: Run dnf update python3.11-pip --releasever 2023.6.20241111 or dnf update --advisory ALAS2023-2024-762 --releasever...

Amazon Linux 2023 : python3.11-pip, python3.11-pip-wheel (ALAS2023-2024-762)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-762 advisory. python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2024-759)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-759 advisory. libexpat through 2.5.0 allows a denial of service resource consumption because many full reparsings are required in the case of a large token for which multiple buffer fills are needed...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2024-761)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-761 advisory. Vim is an open source command line text editor. Vim v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2024-753)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-753 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle...

Amazon Linux 2023 : bsdcat, bsdcpio, bsdtar (ALAS2023-2024-742)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-742 advisory. executefilteraudio in archivereadsupportformatrar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst. CVE-2024-48957...

Amazon Linux 2023 : ruby3.2, ruby3.2-bundled-gems, ruby3.2-default-gems (ALAS2023-2024-743)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-743 advisory. An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., GET /admin...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-724)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-724 advisory. In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix AUX buffer serialization CVE-2024-46713 In the Linux kernel, the following vulnerability has been resolved:...

Amazon Linux 2023 : libgcrypt, libgcrypt-devel (ALAS2023-2024-736)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-736 advisory. A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA...

Amazon Linux 2023 : runc (ALAS2023-2024-725)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-725 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or...

Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2024-734)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-734 advisory. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

Amazon Linux 2023 : liboath, liboath-devel, libpskc (ALAS2023-2024-722)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-722 advisory. oath-toolkit: Local root exploit in a PAM module CVE-2024-47191 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested...

Amazon Linux 2023 : clamav, clamav-data, clamav-devel (ALAS2023-2024-737)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-737 advisory. A vulnerability in the PDF parsing module of Clam AntiVirus ClamAV versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x...

Amazon Linux 2023 : bubblewrap (ALAS2023-2024-726)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-726 advisory. A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can...

Amazon Linux 2023 : orc, orc-compiler, orc-devel (ALAS2023-2024-728)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-728 advisory. Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary...

Amazon Linux 2023 : python3.11-pip, python3.11-pip-wheel (ALAS2023-2024-729)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-729 advisory. urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2024-719)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-719 advisory. NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses...

Amazon Linux 2023 : cups-filters, cups-filters-devel, cups-filters-libs (ALAS2023-2024-723)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-723 advisory. 2024-11-13: CVE-2024-47850 was added to this advisory. CUPS is a standards-based, open-source printing system, and libcupsfilters contains the code of the filters of the former cups-filters...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2024-730)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-730 advisory. urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However...