Amazon Linux 2 : aws-kinesis-agent (ALAS-2021-1733)

The version of aws-kinesis-agent installed on the remote host is prior to 2.0.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1733 advisory. A flaw was found in the Apache Log4j logging library 2.x. when the logging configuration uses a non- default Pattern Layo...

Amazon Linux 2 : log4j-cve-2021-44228-hotpatch (ALAS-2021-1732)

The version of log4j-cve-2021-44228-hotpatch installed on the remote host is prior to 1.1-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1732 advisory. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-13 will now explicitly mimic...

Important: log4j-cve-2021-44228-hotpatch

Issue Overview: The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-13 will now explicitly mimic the permissions of the JVM attempting to be updated. Affected Packages: log4j-cve-2021-44228-hotpatch Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALAS-2021-001) (deprecated)

This plugin has been deprecated following detection of an issue with overlapping filenames. Deprecated by al2ALASCORRETTO8-2021-001.nasl plugin ID 160410 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amazon Linux 2 Security Advisory...

Amazon Linux 2 : java-17-amazon-corretto, java-11-amazon-corretto, java-1.8.0-openjdk, java-1.7.0-openjdk (ALAS-2021-1731)

The version of java-1.7.0-openjdk installed on the remote host is prior to 1.7.0.261-2.6.22.2. The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.312.b07-1. The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.13+8-2. The version of...

Amazon Linux 2 : aws-kinesis-agent (ALAS-2021-1730)

The version of aws-kinesis-agent installed on the remote host is prior to 2.0.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1730 advisory. Amazon Kinesis Agent versions within Amazon Linux 2 AL2 prior to aws-kinesis-agent-2.0.4-1 included a version of...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2021-1726)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.312.b07-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1726 advisory. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component:...

Amazon Linux 2 : curl (ALAS-2021-1724)

The version of curl installed on the remote host is prior to 7.79.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1724 advisory. A flaw was found in libcurl. When sending data to an MQTT server could in some situations lead to libcurl using already free...

Low: 389-ds-base

Issue Overview: A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose...

Amazon Linux 2 : vim (ALAS-2021-1728)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1728 advisory. 2024-05-09: CVE-2020-20703 was added to this advisory. Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter. CVE-2020-20703...

Amazon Linux 2 : cyrus-imapd (ALAS-2021-1725)

The version of cyrus-imapd installed on the remote host is prior to 2.4.22-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1725 advisory. A flaw was found in cyrus-imapd. A bad string hashing algorithm used in internal hash tables allows user inputs to be stored i...

Amazon Linux 2 : 389-ds-base (ALAS-2021-1723)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1723 advisory. A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then...

Amazon Linux 2 : kernel (ALAS-2021-1727)

The version of kernel installed on the remote host is prior to 4.14.256-197.484. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1727 advisory. 2024-08-14: CVE-2021-47203 was added to this advisory. 2024-08-14: CVE-2021-47184 was added to this advisory...

Amazon Linux 2 : nss, nss-util, nss-softokn, nspr (ALAS-2021-1722)

The version of nspr installed on the remote host is prior to 4.32.0-1. The version of nss installed on the remote host is prior to 3.67.0-4. The version of nss-softokn installed on the remote host is prior to 3.67.0-3. The version of nss- util installed on the remote host is prior to 3.67.0-1. It...

Medium: docker

Issue Overview: A flaw was found in moby. Moby buildkit calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call. CVE-2020-27534 Affected Packages: docker Note: This advisory is applicable to Amazon Linux 2 -...

Medium: docker

Issue Overview: A flaw was found in moby. Moby buildkit calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call. CVE-2020-27534 Affected Packages: docker Note: This advisory is applicable to Amazon Linux 2 -...

Medium: containerd

Issue Overview: A flaw was found in containerd. Credentials may be leaked during an image pull. CVE-2020-15157 Affected Packages: containerd Note: This advisory is applicable to Amazon Linux 2 - Nitro-enclaves Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ secti...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2021-1718)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.13+8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1718 advisory. There is a flaw in the xml entity encoding functionality of libxml2. An attacker who is able to supply...

Amazon Linux 2 : kernel (ALAS-2021-1719)

The version of kernel installed on the remote host is prior to 4.14.252-195.481. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1719 advisory. A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the...

Amazon Linux 2 : thunderbird (ALAS-2021-1720)

The version of thunderbird installed on the remote host is prior to 78.14.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1720 advisory. Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these bugs showe...