Important: golist

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: golist Note: This advisory is applicable to Amazon Lin...

Important: python

Issue Overview: An XML External Entity XXE issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities. CVE-2022-48565 Affected Packages: python Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Amazon Linux 2 : docker (ALASECS-2023-019)

The version of docker installed on the remote host is prior to 20.10.25-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-019 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Templates did not properly consider backticks...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASNITRO-ENCLAVES-2023-033)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.7.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2023-033 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request...

Amazon Linux 2 : containerd (ALASECS-2023-017)

The version of containerd installed on the remote host is prior to 1.6.19-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-017 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many stream...

Low: vim

Issue Overview: The severity level was changed from Medium to Low. NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960. CVE-2023-5441 Use After Free in GitHub repository vim/vim prior to v9.0.2010. CVE-2023-5535 Affected Packages: vim Note: This...

Medium: nautilus

Issue Overview: GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename application crash via a pasted ZIP archive. CVE-2022-37290 Affected Packages: nautilus Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between A...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2023-016)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.27.2.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-016 advisory. An issue was found in libcurl which allows cookies to be inserted into a running program if specif...

Important: kernel-livepatch-5.10.192-182.736

Issue Overview: A use-after-free vulnerability in the Linux kernel's net/sched: schhfsc HFSC qdisc traffic control component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve i.e. with the HFSCFSC flag set has a parent without a link-sharing curve, then...

Important: open-vm-tools

Issue Overview: VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be ab...

Important: cri-tools

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: cri-tools Note: This advisory is applicable to Amazon...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASDOCKER-2023-034)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.7.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2023-034 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation c...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2023-029)

The version of kernel installed on the remote host is prior to 5.15.136-90.144. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-029 advisory. 2024-07-03: CVE-2023-52504 was added to this advisory. 2024-07-03: CVE-2023-52559 was added to this...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-042 (ALASKERNEL-5.10-2023-042)

The version of kernel installed on the remote host is prior to 5.10.198-187.748. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-042 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: unregister...

Amazon Linux 2 : runc (ALASECS-2023-018)

The version of runc installed on the remote host is prior to 1.1.7-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-018 advisory. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signature...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-055)

The version of kernel installed on the remote host is prior to 5.4.258-171.360. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-055 advisory. 2024-07-03: CVE-2023-52573 was added to this advisory. 2024-07-03: CVE-2023-52522 was added to this...

Medium: kernel

Issue Overview: A flaw in the kernel Xen event handler can cause a deadlock with Xen console handling in unprivileged Xen guests. CVE-2023-34324 A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer skb was assumed to be associated with a device before callin...

Important: cni-plugins

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: cni-plugins Note: This advisory is applicable to Amazo...

Amazon Linux AMI : squid (ALAS-2023-1872)

The version of squid installed on the remote host is prior to 3.5.20-17.50. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1872 advisory. Due to a buffer overflow bug Squid is vulnerable to a Denial of Service attack against HTTP Digest Authentication CVE-2023-46847...

Amazon Linux 2023 : squid (ALAS2023-2023-402)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-402 advisory. Due to a buffer overflow bug Squid is vulnerable to a Denial of Service attack against HTTP Digest Authentication CVE-2023-46847 Tenable has extracted the preceding description block directly from the...