Amazon Linux AMI : telnet (ALAS-2020-1387)

The version of telnet installed on the remote host is prior to 0.17-49.9. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1387 advisory. utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent dat...

Amazon Linux 2 : microcode_ctl (ALAS-2020-1444)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1444 advisory. A new domain bypass transient execution attack known as Special Register Buffer Data Sampling SRBDS has been found. Th...

Amazon Linux 2 : tomcat (ALAS-2020-1449)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1449 advisory. When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a an attacke...

Amazon Linux AMI : tomcat8 (ALAS-2020-1390)

The version of tomcat8 installed on the remote host is prior to 8.5.56-1.84. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1390 advisory. When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a an...

Low: python-urllib3

Issue Overview: No CVE associated with this advisory Affected Packages: python-urllib3 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update python-urllib3 or...

Medium: libexif

Issue Overview: An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. This is different from CVE-2020-0093. CVE-2020-13112 Affected Packages: libexif Note: This advisory is applicable to Amazon Linu...

Medium: json-c

Issue Overview: json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbufmemappend. CVE-2020-12762 Affected Packages: json-c Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

Important: nghttp2

Issue Overview: In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes 2400 individual settings entries over and over again. The...

Important: tomcat

Issue Overview: When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a an attacker is able to control the contents and name of a file on the server; and b the server is configured to use the PersistenceManager with a FileStore; and ...

Important: kernel-livepatch-4.14.177-139.254

Issue Overview: A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending...

Amazon Linux 2 : polkit (ALAS-2020-1437)

The version of polkit installed on the remote host is prior to 0.112-26. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1437 advisory. A flaw was found in polkit before version 0.116. The implementation of the polkitbackendinteractiveauthoritycheckauthorization...

Amazon Linux 2 : libsndfile (ALAS-2020-1435)

The version of libsndfile installed on the remote host is prior to 1.0.25-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1435 advisory. A stack-based buffer overflow in psfmemset in common.c in libsndfile 1.0.28 allows remote attackers to cause a denial of servi...

Amazon Linux 2 : mod_auth_mellon (ALAS-2020-1436)

The version of modauthmellon installed on the remote host is prior to 0.14.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1436 advisory. modauthmellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // afte...

Amazon Linux 2 : kernel (ALAS-2020-1440)

The version of kernel installed on the remote host is prior to 4.14.177-139.253. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1440 advisory. A flaw was found in the Linux kernel's implementation of the BFQ IO scheduler. This flaw allows a local user able ...

Amazon Linux 2 : wireshark (ALAS-2020-1438)

The version of wireshark installed on the remote host is prior to 1.10.14-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1438 advisory. In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Radiotap dissector could crash. This was...

Amazon Linux 2 : zsh (ALAS-2020-1439)

The version of zsh installed on the remote host is prior to 5.7.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1439 advisory. In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwri...

Medium: mod_auth_mellon

Issue Overview: modauthmellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL. CVE-2019-13038 Affected Packages: modauthmellon Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit thi...

Important: fribidi

Issue Overview: A buffer overflow in the fribidigetparembeddinglevelsex function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered b...

Amazon Linux 2 : fribidi (ALAS-2020-1434)

The version of fribidi installed on the remote host is prior to 1.0.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1434 advisory. A buffer overflow in the fribidigetparembeddinglevelsex function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an...

Amazon Linux AMI : unbound (ALAS-2020-1373)

The version of unbound installed on the remote host is prior to 1.6.6-1.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1373 advisory. A network amplification vulnerability was found in Unbound, in the way it processes delegation messages from one...