Amazon Linux AMI : docker (ALAS-2020-1376)

The version of docker installed on the remote host is prior to 19.03.6ce-4.58. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1376 advisory. An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAPNETRAW capability, can craft...

Amazon Linux AMI : python27 (ALAS-2020-1375)

The version of python27 installed on the remote host is prior to 2.7.18-1.137. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1375 advisory. http.cookiejar.DefaultPolicy.domainreturnok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly valida...

Amazon Linux 2 : python, --advisory ALAS2-2020-1432 (ALAS-2020-1432)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1432 advisory. http.cookiejar.DefaultPolicy.domainreturnok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain:...

Amazon Linux AMI : ppp (ALAS-2020-1371)

The version of ppp installed on the remote host is prior to 2.4.5-11.9. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1371 advisory. eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eaprequest and eapresponse functions.CVE-2020-8597...

Amazon Linux AMI : python-twisted-web (ALAS-2020-1372)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1372 advisory. In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set ...

Amazon Linux AMI : bind (ALAS-2020-1369)

The version of bind installed on the remote host is prior to 9.8.2-0.68.rc1.64. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1369 advisory. A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed wh...

Amazon Linux AMI : squid (ALAS-2020-1378)

The version of squid installed on the remote host is prior to 3.5.20-15.39. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1378 advisory. An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls...

Amazon Linux 2 : xorg-x11-server (ALAS-2020-1433)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1433 advisory. It was discovered that libX11 does not properly validate input coming from the server, causing XListExtensions and XGetFontPath functions to produce an invalid list of elements that in turn make...

Amazon Linux AMI : httpd24 (ALAS-2020-1370)

The version of httpd24 installed on the remote host is prior to 2.4.43-1.89. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1370 advisory. In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with modrewrite that were intended to be self-referential...

Medium: python

Issue Overview: http.cookiejar.DefaultPolicy.domainreturnok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has anoth...

Important: kernel-livepatch-4.14.171-136.231

Issue Overview: An issue was discovered in the Linux kernel before 5.6.5. There is a use-after-free in block/bfq-iosched.c related to bfqidleslicetimerbody.CVE-2020-12657 Affected Packages: kernel-livepatch-4.14.171-136.231 Issue Correction: Please ensure you have live patching enabled. Run yum...

Amazon Linux 2 : python-twisted-web (ALAS-2020-1428)

The version of python-twisted-web installed on the remote host is prior to 12.1.0-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1428 advisory. In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a...

Amazon Linux 2 : bind (ALAS-2020-1426)

The version of bind installed on the remote host is prior to 9.11.4-9.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1426 advisory. An assertion failure was found in BIND, which checks the validity of messages containing TSIG resource records. This flaw...

Amazon Linux 2 : unbound (ALAS-2020-1430)

The version of unbound installed on the remote host is prior to 1.6.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1430 advisory. infinite loop via malformed DNS answers received from upstream servers CVE-2020-12663 insufficient control of network...

Amazon Linux 2 : httpd (ALAS-2020-1427)

The version of httpd installed on the remote host is prior to 2.4.43-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1427 advisory. In Apache HTTP Server 2.4.0 to 2.4.41, modproxyftp may use uninitialized memory when proxying to a malicious FTP server...

Important: unbound

Issue Overview: infinite loop via malformed DNS answers received from upstream servers CVE-2020-12663 insufficient control of network message volume leads to DoS CVE-2020-12662 Affected Packages: unbound Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ secti...

Amazon Linux AMI : php72 (ALAS-2020-1367)

The version of php72 installed on the remote host is prior to 7.2.30-1.22. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1367 advisory. In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while parsing EXIF data with exifreaddata...

Amazon Linux AMI : dovecot (ALAS-2020-1363)

The version of dovecot installed on the remote host is prior to 2.2.36-6.19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1363 advisory. In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker...

Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2020-1365)

The version of java-1.7.0-openjdk installed on the remote host is prior to 1.7.0.261-2.6.22.1.83. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1365 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...

Amazon Linux AMI : php73 (ALAS-2020-1368)

The version of php73 installed on the remote host is prior to 7.3.17-1.25. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1368 advisory. In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while parsing EXIF data with exifreaddata...