Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2024-719)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-719 advisory. NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses...

Amazon Linux 2023 : cups-filters, cups-filters-devel, cups-filters-libs (ALAS2023-2024-723)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-723 advisory. 2024-11-13: CVE-2024-47850 was added to this advisory. CUPS is a standards-based, open-source printing system, and libcupsfilters contains the code of the filters of the former cups-filters...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2024-730)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-730 advisory. urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2024-721)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-721 advisory. Issue summary: Applications performing certificate name checks e.g., TLSclients checking server certificates may attempt to read an invalid memoryaddress resulting in abnormal termination of the...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2024-735)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-735 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing...

Amazon Linux 2023 : python3-dns, python3-dns+dnssec, python3-dns+idna (ALAS2023-2024-739)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-739 advisory. eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-731)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-731 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: walk over current view on netlink dump CVE-2024-27017 In the Linux kernel, the following vulnerabili...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2024-727)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-727 advisory. Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers from the client side to trigger unnecessarily expensive...

Amazon Linux 2023 : gdb, gdb-gdbserver, gdb-headless (ALAS2023-2024-738)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-738 advisory. GNU gdb GDB 13.0.50.20220805-git was discovered to contain a stack overflow via the function adadecode at /gdb/ada-lang.c. CVE-2023-39128 GNU gdb GDB 13.0.50.20220805-git was discovered to...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2024-720)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-720 advisory. libtiff: NULL pointer dereference in tifdirinfo.c CVE-2024-7006 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2024-717)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-717 advisory. Denial-of-service due to unbounded pattern matching CVE-2024-31228 Lua library commands may be exploited by an authenticated user to achieve remote-code-execution CVE-2024-31449 Tenable has...

Amazon Linux 2023 : cups-filters, cups-filters-devel, cups-filters-libs (ALAS2023-2024-718)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-718 advisory. A flaw in cups-filters allows a remote unauthenticated client to create a PPD configuration file with code injection. If a job is sent to the compromised printer, the code is executed allowing for remot...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2024-716)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-716 advisory. 2024-09-26: CVE-2024-22374 was added to this advisory. Improper isolation in some IntelR Processors stream cache mechanism may allow an authenticated user to potentially enable escalation of...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-715)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-715 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize CVE-2024-35807 Tenable has extracted the preceding description block directly from the test...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-714)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-714 advisory. In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: enhanced error handling for tightly received RTS messages in xtprxrtssessionnew CVE-2023-52887 In the Linux...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-713)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-713 advisory. 2024-10-10: CVE-2024-44974 was added to this advisory. 2024-10-10: CVE-2024-44946 was added to this advisory. 2024-10-10: CVE-2024-46679 was added to this advisory. 2024-10-10: CVE-2024-46711 w...

Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2024-707)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-707 advisory. NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpmp4module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2024-712)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-712 advisory. Insufficient control flow management for some IntelR Xeon Processors may allow an authenticated user to potentially enable denial of service via local access. CVE-2024-22374 Tenable has extracted the...

Amazon Linux 2023 : docker (ALAS2023-2024-711)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-711 advisory. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2024-708)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-708 advisory. Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255 The OpenTelemetry Collector offers a vendor-agnostic implementation on how to...