Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2023-291)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-291 advisory. A heap-based buffer overflow flaw was found in Redis. This flaw allows an attacker to trick an authenticated user into executing a specially crafted Lua script in Redis. This attack triggers a heap...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-038)

The version of kernel installed on the remote host is prior to 5.10.186-179.751. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-038 advisory. 2024-07-03: CVE-2023-3389 was added to this advisory. 2023-08-31: CVE-2023-20569 was added to this...

Amazon Linux 2023 : python3-mako (ALAS2023-2023-288)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-288 advisory. Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin. CVE-2022-40023 Tenable has extract...

Amazon Linux 2 : openssh (ALAS-2023-2176)

The version of openssh installed on the remote host is prior to 7.4p1-22. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2176 advisory. The PKCS11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-277)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-277 advisory. Kafka dissector crash in Wireshark 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 allows denial of service via packet injection or crafted capture file CVE-2023-3648 iSCSI dissector crash in Wireshark 4.0....

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-025 (ALASKERNEL-5.15-2023-025)

The version of kernel installed on the remote host is prior to 5.15.122-77.145. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-025 advisory. An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for...

Amazon Linux 2023 : pcre2, pcre2-devel, pcre2-static (ALAS2023-2023-286)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-286 advisory. Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. CVE-2022-41409 Tenable has extracted the preceding...

Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2023-280)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-280 advisory. A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence o...

Amazon Linux 2 : ImageMagick (ALAS-2023-2178)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2178 advisory. A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel function in quantum- private.h. This issue may...

Amazon Linux 2 : cni-plugins (ALAS-2023-2192)

The version of cni-plugins installed on the remote host is prior to 1.2.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2192 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-050)

The version of kernel installed on the remote host is prior to 5.4.250-166.369. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-050 advisory. An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2023-276)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-276 advisory. Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices with the %pipe% prefix or the | pipe character prefix. CVE-2023-36664 Tenable has extracted the preceding descriptio...

Amazon Linux 2023 : iperf3, iperf3-devel (ALAS2023-2023-274)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-274 advisory. iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. CVE-2023-38403 Tenable has extracted the preceding description block directly from the tested...

Amazon Linux AMI : nghttp2 (ALAS-2023-1793)

The version of nghttp2 installed on the remote host is prior to 1.33.0-1.1.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1793 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

Amazon Linux 2023 : yajl, yajl-devel (ALAS2023-2023-279)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-279 advisory. There's a memory leak in yajl 2.1.0 with use of yajltreeparse function. which will cause out-of-memory in server and cause crash. CVE-2023-33460 Tenable has extracted the preceding description block...

Amazon Linux 2 : nerdctl (ALAS-2023-2193)

The version of nerdctl installed on the remote host is prior to 1.1.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2193 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the...

Amazon Linux 2 : golist (ALAS-2023-2185)

The version of golist installed on the remote host is prior to 0.10.1-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2185 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional...

Amazon Linux AMI : ImageMagick (ALAS-2023-1791)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1.27. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1791 advisory. A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel function in quantum- private.h. This issue ma...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2023-2189)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.382.b05-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2189 advisory. Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Jav...

Amazon Linux 2023 : libnghttp2, libnghttp2-devel, nghttp2 (ALAS2023-2023-278)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-278 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY fram...