Amazon Linux 2 : systemd (ALAS-2021-1643) (deprecated)

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1643 advisory. - A vulnerability in unitdeserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution vi...

Medium: python-pip

Issue Overview: The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in...

Medium: openldap

Issue Overview: A NULL pointer dereference flaw was found in the OpenLDAP server, during a request for renaming RDNs. This flaw allows a remote, unauthenticated attacker to crash the slapd process by sending a specially crafted request, causing a denial of service. The highest threat from this...

Amazon Linux AMI : xorg-x11-server (ALAS-2021-1502)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1502 advisory. A flaw was found in xorg-x11-server. An interger underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and...

Amazon Linux AMI : ruby24 (ALAS-2021-1501)

The version of ruby24 installed on the remote host is prior to 2.4.10-2.14. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1501 advisory. The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-tri...

Amazon Linux AMI : python36 (ALAS-2021-1500)

The version of python36 installed on the remote host is prior to 3.6.12-1.21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1500 advisory. The package python/cpython is vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by...

Amazon Linux AMI : runc (ALAS-2021-1499)

The version of runc installed on the remote host is prior to 1.0.0-0.3.20210225.git12644e6.4. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1499 advisory. The runc package is vulnerable to a symlink exchange attack whereby an attacker can request a seemingly innocuo...

Amazon Linux AMI : busybox (ALAS-2021-1496)

The version of busybox installed on the remote host is prior to 1.19.3-2.12. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1496 advisory. decompressgunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huftbuild result pointer, with a resultant invalid...

Amazon Linux AMI : exim (ALAS-2021-1497)

The version of exim installed on the remote host is prior to 4.92-1.27. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1497 advisory. Prior versions of Exim 4 have Improper Neutralization of Line Delimiters. Local users can alter the behavior of root process...

Amazon Linux AMI : python35 (ALAS-2021-1498)

The version of python35 installed on the remote host is prior to 3.5.10-1.30. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1498 advisory. The package python/cpython is vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by...

Amazon Linux 2 : xorg-x11-server (ALAS-2021-1633)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1633 advisory. A flaw was found in xorg-x11-server. An interger underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and...

Low: kernel-livepatch-4.14.219-161.340

Issue Overview: A low severity issue was found in the Nitro Enclaves Linux kernel driver that could lead to local privilege escalation. The issue does not break the isolation or security of what is running inside the enclave as the Nitro Enclave's security model already excludes the instance...

Important: xorg-x11-server

Issue Overview: A flaw was found in xorg-x11-server. An interger underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2021-3472 Affected Packages:...

Low: kernel-livepatch-4.14.219-164.354

Issue Overview: A low severity issue was found in the Nitro Enclaves Linux kernel driver that could lead to local privilege escalation. The issue does not break the isolation or security of what is running inside the enclave as the Nitro Enclave's security model already excludes the instance...

Low: kernel-livepatch-4.14.225-168.357

Issue Overview: A low severity issue was found in the Nitro Enclaves Linux kernel driver that could lead to local privilege escalation. The issue does not break the isolation or security of what is running inside the enclave as the Nitro Enclave's security model already excludes the instance...

Low: kernel

Issue Overview: A low severity issue was found in the Nitro Enclaves Linux kernel driver that could lead to local privilege escalation. The issue does not break the isolation or security of what is running inside the enclave as the Nitro Enclave's security model already excludes the instance...

Low: kernel-livepatch-4.14.231-173.360

Issue Overview: A low severity issue was found in the Nitro Enclaves Linux kernel driver that could lead to local privilege escalation. The issue does not break the isolation or security of what is running inside the enclave as the Nitro Enclave's security model already excludes the instance...

Amazon Linux 2 : libldb (ALAS-2021-1628)

The version of libldb installed on the remote host is prior to 1.5.4-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1628 advisory. A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory...

Amazon Linux 2 : pki-core (ALAS-2021-1630)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1630 advisory. A Reflected Cross Site Scripting flaw was found in the pki-ca module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could...

Amazon Linux 2 : kernel (ALAS-2021-1627)

The version of kernel installed on the remote host is prior to 4.14.231-173.360. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1627 advisory. A memory leak in the adisupdatescanmode function in drivers/iio/imu/adisbuffer.c in the Linux kernel before 5.3.9...