Medium: python

Issue Overview: The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which...

Amazon Linux 2 : qt5-qtwebsockets (ALAS-2024-2661)

The version of qt5-qtwebsockets installed on the remote host is prior to 5.15.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2661 advisory. An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x...

Amazon Linux 2 : python38 (ALASPYTHON3.8-2024-014)

The version of python38 installed on the remote host is prior to 3.8.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PYTHON3.8-2024-014 advisory. The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong...

Amazon Linux 2 : python (ALAS-2024-2686)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2686 advisory. The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion o...

Amazon Linux 2 : qt5-qt3d (ALAS-2024-2659)

The version of qt5-qt3d installed on the remote host is prior to 5.15.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2659 advisory. An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: fou: fix initialization of grc CVE-2024-46865 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.4 Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and thi...

Amazon Linux 2023 : ruby3.2, ruby3.2-bundled-gems, ruby3.2-default-gems (ALAS2023-2024-743)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-743 advisory. An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., GET /admin...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2024-753)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-753 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle...

Amazon Linux 2023 : bsdcat, bsdcpio, bsdtar (ALAS2023-2024-742)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-742 advisory. executefilteraudio in archivereadsupportformatrar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst. CVE-2024-48957...

Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2024-752)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-752 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle...

Important: python3.11-setuptools

Issue Overview: A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptibl...

Important: libarchive

Issue Overview: executefilteraudio in archivereadsupportformatrar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst. CVE-2024-48957 executefilterdelta in archivereadsupportformatrar.c in libarchive before 3.7.5 allows out-of-bounds...

Important: ruby3.2

Issue Overview: An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's...

Amazon Linux 2023 : flatpak, flatpak-devel, flatpak-libs (ALAS2023-2024-745)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-745 advisory. A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can...

Medium: python38

Issue Overview: The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which...

Amazon Linux 2023 : python3-urllib3 (ALAS2023-2024-747)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-747 advisory. urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However...

Medium: python-twisted

Issue Overview: Twisted is an event-based framework for internet applications, supporting Python 3.6+. The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected...

Amazon Linux 2023 : poppler, poppler-cpp, poppler-cpp-devel (ALAS2023-2024-741)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-741 advisory. A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to cras...

Amazon Linux 2023 : kernel (ALAS2023-2024-755)

The version of kernel installed on the remote host is prior to 6.1.111-120.187. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-755 advisory. In the Linux kernel, the following vulnerability has been resolved: arm64: acpi: Harden getcpuforacpiid against...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2024-748)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-748 advisory. 2024-12-05: CVE-2024-21820 was added to this advisory. 2024-12-05: CVE-2024-21853 was added to this advisory. 2024-12-05: CVE-2024-23918 was added to this advisory. Incorrect default permission...