Amazon Linux 2 : curl (ALAS-2022-1808)

The version of curl installed on the remote host is prior to 7.79.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1808 advisory. A vulnerability was found in curl. This issue occurs because curl can reuse a previously created connection even when a TLS or...

Amazon Linux 2 : expat (ALAS-2022-1809)

The version of expat installed on the remote host is prior to 2.1.0-14. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1809 advisory. In doProlog in xmlparse.c in Expat aka libexpat before 2.4.3, an integer overflow exists for mgroupSize. CVE-2021-46143...

Amazon Linux 2 : libtiff (ALAS-2022-1814)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1814 advisory. A flaw was found in libtiff where a NULL source pointer passed as an argument to the memcpy function within the...

Amazon Linux 2 : rust (ALAS-2022-1816)

The version of rust installed on the remote host is prior to 1.56.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1816 advisory. In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized byt...

Amazon Linux 2 : rust (ALAS-2022-1817)

The version of rust installed on the remote host is prior to 1.61.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1817 advisory. A race condition flaw was found in Rust's std::fs::removedirall function. Rust applications that use this function may be vulnerable ...

Amazon Linux 2 : kernel, --advisory ALAS2-2022-1813 (ALAS-2022-1813)

The version of kernel installed on the remote host is prior to 4.14.285-215.501. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1813 advisory. A kernel information leak flaw was identified in the scsiioctl function in drivers/scsi/scsiioctl.c in the Linux...

Amazon Linux 2 : amazon-ssm-agent (ALAS-2022-1807)

The version of amazon-ssm-agent installed on the remote host is prior to 3.1.1575.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1807 advisory. A buffer overflow flaw was found in Golang's library encoding/pem. This flaw allows an attacker to use a large PEM...

Amazon Linux 2 : git (ALAS-2022-1810)

The version of git installed on the remote host is prior to 2.34.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1810 advisory. A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system...

Medium: amazon-ssm-agent

Issue Overview: A buffer overflow flaw was found in Golang's library encoding/pem. This flaw allows an attacker to use a large PEM input more than 5 MB , causing a stack overflow in Decode, which leads to a loss of availability. CVE-2022-24675 Affected Packages: amazon-ssm-agent Note: This adviso...

Amazon Linux 2 : thunderbird (ALAS-2022-1818)

The version of thunderbird installed on the remote host is prior to 91.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1818 advisory. crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versio...

Amazon Linux 2 : log4j-cve-2021-44228-hotpatch (ALAS-2022-1806)

The version of log4j-cve-2021-44228-hotpatch installed on the remote host is prior to 1.3-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1806 advisory. Versions of the Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3-5 are affected by a race...

Important: log4j-cve-2021-44228-hotpatch

Issue Overview: Versions of the Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3-5 are affected by a race condition that could lead to a local privilege escalation. The Apache Log4j Hotpatch is not a replacement for updating to a log4j version that mitigates CVE-2021-44228 o...

Amazon Linux 2 : containerd (ALASDOCKER-2022-019)

The version of containerd installed on the remote host is prior to 1.4.13-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2022-019 advisory. A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to...

Amazon Linux 2 : containerd, docker (ALASNITRO-ENCLAVES-2022-019)

The version of containerd installed on the remote host is prior to 1.4.13-2. The version of docker installed on the remote host is prior to 20.10.13-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO- ENCLAVES-2022-019 advisory. A flaw was found in Moby Docker Engine...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2022-001)

The version of kernel installed on the remote host is prior to 5.15.43-20.123. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2022-001 advisory. A flaw was found in unrestricted eBPF usage by the BPFBTFLOAD, leading to a possible out-of-bounds memory...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-014)

The version of kernel installed on the remote host is prior to 5.10.118-111.515. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-014 advisory. In the Linux kernel, the following vulnerability has been resolved: dm: fix mempool NULL pointer race wh...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2022-026 (ALASKERNEL-5.4-2022-026)

The version of kernel installed on the remote host is prior to 5.4.196-108.356. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-026 advisory. In the Linux kernel, the following vulnerability has been resolved: dm: fix mempool NULL pointer race when...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2022-020)

The version of containerd installed on the remote host is prior to 1.4.13-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2022-020 advisory. A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daem...

Amazon Linux 2 : vim, --advisory ALAS2-2022-1805 (ALAS-2022-1805)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1805 advisory. A flaw was found in vim. The vulnerability occurs due to a crash when recording and using Select mode and leads to an out-of-bounds read. This flaw allows an attacker to input a specially crafted...

Amazon Linux 2 : openssl (ALAS-2022-1801)

The version of openssl installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1801 advisory. The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by so...