Amazon Linux 2 : amazon-ecr-credential-helper (ALASNITRO-ENCLAVES-2024-047)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.9.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2024-047 advisory. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASECS-2024-043)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.9.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2024-043 advisory. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses,...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2024-070 (ALASKERNEL-5.10-2024-070)

The version of kernel installed on the remote host is prior to 5.10.226-214.879. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-070 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free after...

Amazon Linux 2 : libreoffice (ALASLIBREOFFICE-2024-004)

The version of libreoffice installed on the remote host is prior to 5.3.6.1-21. It is, therefore, affected by a vulnerability as referenced in the ALAS2LIBREOFFICE-2024-004 advisory. Certificate Validation user interface in LibreOffice allows potential vulnerability. Signed macros are scripts tha...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2024-086 (ALASKERNEL-5.4-2024-086)

The version of kernel installed on the remote host is prior to 5.4.284-196.380. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-086 advisory. In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2024-055 (ALASKERNEL-5.15-2024-055)

The version of kernel installed on the remote host is prior to 5.15.167-112.165. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-055 advisory. In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Fix...

Amazon Linux 2 : php (ALASPHP8.2-2024-005)

The version of php installed on the remote host is prior to 8.2.23-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.2-2024-005 advisory. In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, due to a code logic error, filtering functions such as...

Important: golang

Issue Overview: Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion. CVE-2024-34155 Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name CVE-2024-39494 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between...

Medium: python-pillow

Issue Overview: Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c. CVE-2020-10177 Affected Packages: python-pillow Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras...

Medium: python-dns

Issue Overview: eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred...

Medium: c-ares

Issue Overview: Insufficient randomness in generation of DNS query IDs When /dev/urandom or RtlGenRandom are unavailable, c-ares uses rand to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand so will generate predictable output. Input from th...

Amazon Linux 2 : redis (ALASREDIS6-2024-010)

The version of redis installed on the remote host is prior to 6.2.14-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2024-010 advisory. Denial-of-service due to unbounded pattern matching CVE-2024-31228 Lua library commands may be exploited by an...

Amazon Linux 2 : python38-setuptools (ALASPYTHON3.8-2024-012)

The version of python38-setuptools installed on the remote host is prior to 38.4.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2PYTHON3.8-2024-012 advisory. A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2024-071 (ALASKERNEL-5.10-2024-071)

The version of kernel installed on the remote host is prior to 5.10.225-213.878. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-071 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: don't allow mapping the...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2024-007)

The version of postgresql installed on the remote host is prior to 13.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL13-2024-007 advisory. Time-of-check Time-of-use TOCTOU race condition in pgdump in PostgreSQL allows an object creator to execute arbitrary...

Amazon Linux 2 : libpq (ALASPOSTGRESQL12-2024-012)

The version of libpq installed on the remote host is prior to 12.20-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL12-2024-012 advisory. Time-of-check Time-of-use TOCTOU race condition in pgdump in PostgreSQL allows an object creator to execute arbitrary SQL...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2024-085 (ALASKERNEL-5.4-2024-085)

The version of kernel installed on the remote host is prior to 5.4.283-195.378. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-085 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: don't allow mapping the MM...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-052)

The version of kernel installed on the remote host is prior to 5.15.166-111.163. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-052 advisory. 2024-09-26: CVE-2024-46763 was added to this advisory. 2024-09-26: CVE-2024-46707 was added to this...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2024-084 (ALASKERNEL-5.4-2024-084)

The version of kernel installed on the remote host is prior to 5.4.279-193.377. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-084 advisory. A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function...