Amazon Linux 2 : ruby (ALAS-2021-1641)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1641 advisory. The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an...

Low: lldpad

Issue Overview: lldptool can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an attacker to inject shell control characters into the buffer and impact the behavior of the terminal. CVE-2018-10932 Affected Packages: lldpad Note: This adviso...

Amazon Linux 2 : openldap (ALAS-2021-1638)

The version of openldap installed on the remote host is prior to 2.4.44-23. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1638 advisory. A NULL pointer dereference flaw was found in the OpenLDAP server, during a request for renaming RDNs. This flaw allows a remote,...

Medium: python3

Issue Overview: The package python/cpython is vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon ;, they can cause a difference in the interpretation of...

Amazon Linux 2 : thunderbird (ALAS-2021-1644)

The version of thunderbird installed on the remote host is prior to 78.10.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1644 advisory. Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both a...

Amazon Linux 2 : python3 (ALAS-2021-1640)

The version of python3 installed on the remote host is prior to 3.7.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1640 advisory. The package python/cpython is vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by usin...

Amazon Linux 2 : bind (ALAS-2021-1635)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1635 advisory. A flaw was found in bind. The way DNAME records are processed may trigger the same RRset to the ANSWER section to be added more...

Medium: python-pip

Issue Overview: The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in...

Medium: openldap

Issue Overview: A NULL pointer dereference flaw was found in the OpenLDAP server, during a request for renaming RDNs. This flaw allows a remote, unauthenticated attacker to crash the slapd process by sending a specially crafted request, causing a denial of service. The highest threat from this...

Amazon Linux 2 : systemd (ALAS-2021-1643) (deprecated)

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1643 advisory. - A vulnerability in unitdeserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution vi...

Amazon Linux 2 : kernel (ALAS-2021-1636)

The version of kernel installed on the remote host is prior to 4.14.232-176.381. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1636 advisory. 2024-05-23: CVE-2021-46909 was added to this advisory. 2024-05-23: CVE-2021-46974 was added to this advisory...

Amazon Linux 2 : xorg-x11-server (ALAS-2021-1633)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1633 advisory. A flaw was found in xorg-x11-server. An interger underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and...

Important: xorg-x11-server

Issue Overview: A flaw was found in xorg-x11-server. An interger underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2021-3472 Affected Packages:...

Low: kernel-livepatch-4.14.219-164.354

Issue Overview: A low severity issue was found in the Nitro Enclaves Linux kernel driver that could lead to local privilege escalation. The issue does not break the isolation or security of what is running inside the enclave as the Nitro Enclave's security model already excludes the instance...

Amazon Linux 2 : libldb (ALAS-2021-1628)

The version of libldb installed on the remote host is prior to 1.5.4-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1628 advisory. A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory...

Amazon Linux 2 : squid (ALAS-2021-1631)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1631 advisory. A flaw was found in squid. Due to improper validation while parsing the request URI, squid is vulnerable to HTTP request smuggling...

Amazon Linux 2 : kernel (ALAS-2021-1627)

The version of kernel installed on the remote host is prior to 4.14.231-173.360. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1627 advisory. A memory leak in the adisupdatescanmode function in drivers/iio/imu/adisbuffer.c in the Linux kernel before 5.3.9...

Amazon Linux 2 : thunderbird (ALAS-2021-1632)

The version of thunderbird installed on the remote host is prior to 78.9.0-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1632 advisory. The Mozilla Foundation Security Advisory describes this issue as:A texture upload of a Pixel Buffer Object could have...

Amazon Linux 2 : pki-core (ALAS-2021-1630)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1630 advisory. A Reflected Cross Site Scripting flaw was found in the pki-ca module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could...

Amazon Linux 2 : ipa (ALAS-2021-1626)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1626 advisory. A flaw was found in jQuery. HTML containingelements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest...