Amazon Linux 2 : amazon-ssm-agent (ALAS-2025-2883)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.2299.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2883 advisory. SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which...

Amazon Linux 2023 : python3.11-setuptools, python3.11-setuptools-wheel (ALAS2023-2025-1003)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1003 advisory. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version...

Amazon Linux 2023 : screen (ALAS2023-2025-1006)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1006 advisory. TTY Hijacking while Attaching to a Multiuser Session in the screen package Has potential to break some reattach use cases, but the specific use case was broken already before.screen in Debian not...

Amazon Linux 2023 : bpftool, kernel6.12, kernel6.12-modules-extra (ALAS2023-2025-995)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-995 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: track changespktdata property for global functions CVE-2024-58098 In the Linux kernel, the following vulnerability has...

Amazon Linux 2023 : git, git-all, git-core (ALAS2023-2025-1014)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1014 advisory. Git is a source code management tool. When cloning from a server or fetching, or pushing, informational or error messages are transported from the remote Git process to the client via the so-called...

Amazon Linux 2023 : python3-setuptools, python3-setuptools-wheel (ALAS2023-2025-1005)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1005 advisory. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version...

Amazon Linux 2023 : python3-tornado (ALAS2023-2025-1002)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1002 advisory. Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form- data parser encounters certain errors, it logs a warning but continues trying to parse the remainde...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: udp: Fix memory accounting leak. CVE-2025-22058 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.15 Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and...

Medium: ecs-init

Issue Overview: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result i...

Important: kernel-livepatch-4.14.355-275.603

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: nilfs2: protect access to buffers with no active references CVE-2025-21811 Affected Packages: kernel-livepatch-4.14.355-275.603 Issue Correction: Please ensure you have live patching enabled. Run yum update...

Important: kernel-livepatch-4.14.355-277.647

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: nilfs2: protect access to buffers with no active references CVE-2025-21811 Affected Packages: kernel-livepatch-4.14.355-277.647 Issue Correction: Please ensure you have live patching enabled. Run yum update...

Important: containerd

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Important: kernel-livepatch-4.14.355-276.639

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: nilfs2: protect access to buffers with no active references CVE-2025-21811 Affected Packages: kernel-livepatch-4.14.355-276.639 Issue Correction: Please ensure you have live patching enabled. Run yum update...

Important: kernel-livepatch-4.14.355-277.643

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: nilfs2: protect access to buffers with no active references CVE-2025-21811 Affected Packages: kernel-livepatch-4.14.355-277.643 Issue Correction: Please ensure you have live patching enabled. Run yum update...

Medium: docker

Issue Overview: containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container...

Medium: ecs-init

Issue Overview: containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container...

Important: kernel-livepatch-4.14.355-276.618

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: nilfs2: protect access to buffers with no active references CVE-2025-21811 Affected Packages: kernel-livepatch-4.14.355-276.618 Issue Correction: Please ensure you have live patching enabled. Run yum update...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2025-063)

The version of containerd installed on the remote host is prior to 1.7.27-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2025-063 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminat...

Amazon Linux 2 : ecs-init (ALASECS-2025-065)

The version of ecs-init installed on the remote host is prior to 1.94.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2025-065 advisory. The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2025-074)

The version of kernel installed on the remote host is prior to 5.15.179-122.186. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.15-2025-074 advisory. In the Linux kernel, the following vulnerability has been resolved: udp: Fix memory accounting leak. CVE-2025-220...