Low: clamav

Issue Overview: No CVE associated with this advisory Affected Packages: clamav Issue Correction: Run dnf update clamav --releasever 2023.4.20240513 or dnf update --advisory ALAS2023-2024-615 --releasever 2023.4.20240513 to update your system. More information on how to update your system can be...

Medium: ecs-init

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Amazon Linux AMI : nghttp2 (ALAS-2024-1935)

The version of nghttp2 installed on the remote host is prior to 1.33.0-1.1.9. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1935 advisory. nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 kee...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-613)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-613 advisory. In the Linux kernel, the following vulnerability has been resolved: inet: inetdefrag: prevent sk release while still in use CVE-2024-26921 In the Linux kernel, the following vulnerability has...

Amazon Linux 2023 : clamav, clamav-data, clamav-devel (ALAS2023-2024-615)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-615 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2023 : flatpak, flatpak-devel, flatpak-libs (ALAS2023-2024-611)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-611 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could...

Important: python3.11

Issue Overview: An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can r...

Amazon Linux 2023 : cni-plugins (ALAS2023-2024-618)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-618 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2024-617)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-617 advisory. An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference...

Medium: ecs-init

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Important: ecs-init

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init --releasever 2023.4.20240513 or dnf update --advisory ALAS2023-2024-620 --releasever 2023.4.20240513 to update your system. More informati...

Amazon Linux 2023 : php8.1, php8.1-bcmath, php8.1-cli (ALAS2023-2024-612)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-612 advisory. The vulnerability allows a remote attacker to bypass implemented security restrictions. The vulnerability exists due to the way PHP handles HTTP variable names. A remote attacker can set a...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-620)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-620 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has no...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2024-610)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-610 advisory. An issue was discovered in some DNS recursive resolvers that allows remote attackers to cause a denial of service using a maliciously designed authority and response amplification. CVE-2024-33655 Tenabl...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2024-616)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-616 advisory. An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-619)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-619 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can...

Amazon Linux AMI : kernel (ALAS-2024-1937)

The version of kernel installed on the remote host is prior to 4.14.343-183.564. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1937 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix 4-byte stack OOB write ...

Amazon Linux 2023 : python3-bson, python3-pymongo, python3-pymongo-gridfs (ALAS2023-2024-614)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-614 advisory. Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged...

Amazon Linux AMI : unbound (ALAS-2024-1934)

The version of unbound installed on the remote host is prior to 1.6.6-1.6. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1934 advisory. An issue was discovered in some DNS recursive resolvers that allows remote attackers to cause a denial of service using a...

Important: nodejs

Issue Overview: An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the...