Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2024-545)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-545 advisory. .NET Denial of Service Vulnerability CVE-2024-20672 .NET Denial of Service Vulnerability CVE-2024-21386 .NET Denial of Service Vulnerability CVE-2024-21404 Tenable has extracted the preceding...

Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2024-546)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-546 advisory. A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set- bootflag will create a temporary file with the new grubenv content and rename it to the original...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-039)

The version of kernel installed on the remote host is prior to 5.15.149-99.161. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-039 advisory. dmtablecreate in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to in alloctargets...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2024-006)

The version of postgresql installed on the remote host is prior to 13.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL13-2024-006 advisory. Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute...

Amazon Linux 2023 : perl-Cpanel-JSON-XS (ALAS2023-2024-556)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-556 advisory. The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service. CVE-2022-48623 Tenable has...

Amazon Linux 2023 : composer (ALAS2023-2024-539)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-539 advisory. Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2024-543)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-543 advisory. Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1...

Amazon Linux 2023 : dnsmasq, dnsmasq-utils (ALAS2023-2024-552)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-552 advisory. Certain DNSSEC aspects of the DNS protocol in RFC 4035 and related RFCs allow remote attackers to cause a denial of service CPU consumption via one or more DNSSEC responses when there is a zone...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2024-553)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-553 advisory. Certain DNSSEC aspects of the DNS protocol in RFC 4035 and related RFCs allow remote attackers to cause a denial of service CPU consumption via one or more DNSSEC responses when there is a zone...

Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2024-555)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-555 advisory. The /boot/efi/EFI/fedora/grub.cfg configuration file allows an unprivileged user with physical access to a computer to bypass the GRUB password protection feature on many but not all UEFI-based systems...

Important: libpq

Issue Overview: Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted...

Important: engrampa

Issue Overview: Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution RCE on the target. While handling CPIO archives, the Engrampa Archive manager follows symlin...

Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-544)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-544 advisory. 2024-03-13: CVE-2024-22025 was added to this advisory. The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file...

Low: openssl-snapsafe

Issue Overview: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack The package openssl098e is provided purely for binary compatibility with older Amazon Linux versions. It does not receive security updates. CVE-2024-0727 Affect...

Important: postgresql

Issue Overview: Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted...

Important: postgresql

Issue Overview: Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted...

Medium: postgresql

Issue Overview: A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption. CVE-2021-23222 Affected Packages: postgresql Note: This advisory is applicable to Amazon Linux 2 - Postgresql14 Extra. Visit...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL12-2024-008)

The version of postgresql installed on the remote host is prior to 12.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL12-2024-008 advisory. Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2024-558)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-558 advisory. This update enables libpsl support in curl, which adds protection against domain spanning super cookies as described in section 5.3 of RFC 6265. Tenable has extracted the preceding description block...

Amazon Linux 2 : openssl-snapsafe (ALASOPENSSL-SNAPSAFE-2024-005)

The version of openssl-snapsafe installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2OPENSSL-SNAPSAFE-2024-005 advisory. Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of...