Amazon Linux 2023 : python3-tornado (ALAS2023-2025-792)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-792 advisory. Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to...

Medium: expat

Issue Overview: An issue was discovered in libexpat before 2.6.4. There is a crash within the XMLResumeParser function because XMLStopParser can stop/suspend an unstarted parser. CVE-2024-50602 Affected Packages: expat Issue Correction: Run dnf update expat --releasever 2023.6.20250107 to update...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2024-790)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-790 advisory. Directory traversal vulnerability in the 1 extract and 2 extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. dot dot...

Amazon Linux 2023 : python3.11-pip, python3.11-pip-wheel (ALAS2023-2024-780)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-780 advisory. Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-778)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-778 advisory. In the Linux kernel, the following vulnerability has been resolved: iouring: fix possible deadlock in ioregisteriowqmaxworkers CVE-2024-41080 In the Linux kernel, the following vulnerability ha...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2024-774)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-774 advisory. PS interpreter - check the type of the Pattern Implementation NOTE: https://bugs.ghostscript.com/showbug.cgi?id=707991NOTE: https://cgit.ghostscript.com/cgi-...

Amazon Linux 2023 : avahi, avahi-autoipd, avahi-compat-howl (ALAS2023-2024-771)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-771 advisory. avahi: Avahi Wide-Area DNS Uses Constant Source Port CVE-2024-52615 avahi: Avahi Wide-Area DNS Predictable Transaction IDs CVE-2024-52616 Tenable has extracted the preceding description block...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2024-781)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-781 advisory. Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-784)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-784 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: disallow timeout for anonymous sets CVE-2023-52620 In the Linux kernel, the following vulnerability has...

Amazon Linux 2023 : python3-requests, python3-requests+security, python3-requests+socks (ALAS2023-2024-782)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-782 advisory. Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the...

Security update for SUSE Manager Client Tools

This update fixes the following issues: golang-github-lusitaniae-apacheexporter was updated from version 1.0.1 to 1.0.8: Security issues fixed: CVE-2023-3978: Fixed security bug in x/net dependency in version 1.0.2 bsc1213933 Bugs fixed: Require Go 1.20 when building for RedHat derivatives Versio...

Medium: python-pip

Issue Overview: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Affected Packages: python-pip Issue Correction: Run dnf update python-pip --releasever 2023.6.20241111 to update your system. New Packages: noarch: ...

Medium: python-pillow

Issue Overview: In imagingcms.c, two strcpy calls were able to copy too much data into fixed length strings. This has been fixed by using strncpy instead. CVE-2024-28219 Affected Packages: python-pillow Issue Correction: Run dnf update python-pillow --releasever 2023.6.20241111 or dnf update...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2024-766)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-766 advisory. node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders c...

Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2024-759)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-759 advisory. libexpat through 2.5.0 allows a denial of service resource consumption because many full reparsings are required in the case of a large token for which multiple buffer fills are needed...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2024-760)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-760 advisory. unbound: NULL Pointer Dereference in Unbound CVE-2024-43167 unbound: Heap-Buffer-Overflow in Unbound CVE-2024-43168 Tenable has extracted the preceding description block directly from the teste...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2024-761)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-761 advisory. Vim is an open source command line text editor. Vim v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit...

Amazon Linux 2023 : python3.11-pip, python3.11-pip-wheel (ALAS2023-2024-762)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-762 advisory. python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Tenable has extracted the preceding description block directly from the tested product...

Medium: python-pillow

Issue Overview: In imagingcms.c, two strcpy calls were able to copy too much data into fixed length strings. This has been fixed by using strncpy instead. CVE-2024-28219 Affected Packages: python-pillow Issue Correction: Run dnf update python-pillow --releasever 2023.6.20241111 to update your...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2024-757)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-757 advisory. There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted...