Important: apache-commons-compress

Issue Overview: Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue. CVE-2024-25710 Affected Packages:...

Important: rust

Issue Overview: RUSTSEC-2024-0006 NOTE: https://rustsec.org/advisories/RUSTSEC-2024-0006.html NOTE: https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27 Affected Packages: rust Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section f...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2024-018)

The version of tomcat installed on the remote host is prior to 8.5.95-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2024-018 advisory. Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through...

Amazon Linux 2 : apache-commons-compress (ALAS-2024-2493)

The version of apache-commons-compress installed on the remote host is prior to 1.5-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2493 advisory. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress.This issue affects Apac...

Amazon Linux 2 : libpq (ALASPOSTGRESQL14-2024-010)

The version of libpq installed on the remote host is prior to 14.8-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-010 advisory. In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2024-012)

The version of tomcat installed on the remote host is prior to 9.0.83-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2024-012 advisory. Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through...

Amazon Linux 2 : rust (ALAS-2024-2504)

The version of rust installed on the remote host is prior to 1.68.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2504 advisory. RUSTSEC-2024-0006 NOTE: https://rustsec.org/advisories/RUSTSEC-2024-0006.html NOTE:...

Amazon Linux 2 : ruby (ALAS-2024-2503)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2503 advisory. The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant ...

Amazon Linux 2 : grub2 (ALAS-2024-2499)

The version of grub2 installed on the remote host is prior to 2.06-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2499 advisory. A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set- bootflag will create a...

Amazon Linux 2 : pcs (ALAS-2024-2492)

The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2492 advisory. A Denial of Service DoS vulnerability was found in rubygem-rack in how it parses Content-Type. Carefully crafted content typ...

Medium: fontforge

Issue Overview: Splinefont in FontForge through 20230101 allows command injection via crafted filenames. CVE-2024-25081 Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files. CVE-2024-25082 Affected Packages: fontforge Note: This advisory is...

Amazon Linux 2 : microcode_ctl (ALAS-2024-2491)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2491 advisory. Non-transparent sharing of return predictor targets between contexts in some Intel Processors may allow an authorized...

Medium: microcode_ctl

Issue Overview: Non-transparent sharing of return predictor targets between contexts in some Intel® Processors may allow an authorized user to potentially enable information disclosure via local access. CVE-2023-38575 Protection mechanism failure of bus lock regulator for some Intel® Processors m...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-034)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.27.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-034 advisory. Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happ...

Amazon Linux 2 : libpq (ALASPOSTGRESQL14-2024-009)

The version of libpq installed on the remote host is prior to 14.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-009 advisory. A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certifica...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2024-006)

The version of postgresql installed on the remote host is prior to 13.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL13-2024-006 advisory. Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL14-2024-008)

The version of postgresql installed on the remote host is prior to 14.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-008 advisory. A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL14-2024-006)

The version of postgresql installed on the remote host is prior to 14.11-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-006 advisory. Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute...

Amazon Linux 2 : libpq (ALASPOSTGRESQL14-2024-007)

The version of libpq installed on the remote host is prior to 14.11-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-007 advisory. Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary...

Amazon Linux 2 : containerd (ALASECS-2024-035)

The version of containerd installed on the remote host is prior to 1.7.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-035 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset ma...