Amazon Linux 2 : glib2 (ALAS-2021-1711)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1711 advisory. An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If gbytearraynewtake was called with a buffer of 4GB o...

Amazon Linux 2 : ca-certificates (ALAS-2021-1710)

The version of ca-certificates installed on the remote host is prior to 2021.2.50-72. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1710 advisory. Update of ca-certificates to version 2021.2.50-72.amzn2.0.1 addresses the expiring IdentTrust DST Root CA X3, which...

Amazon Linux AMI : ca-certificates (ALAS-2021-1536)

The version of ca-certificates installed on the remote host is prior to 2018.2.22-65.1.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1536 advisory. Update of ca-certificates to version 2018.2.22-65.1.24.amzn1 addresses the expiring IdentTrust DST Root CA X3, whi...

Amazon Linux AMI : sssd (ALAS-2021-1542)

The version of sssd installed on the remote host is prior to 1.16.4-21.26. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1542 advisory. A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs- fetch and cache-expire...

Amazon Linux AMI : golang (ALAS-2021-1538)

The version of golang installed on the remote host is prior to 1.15.15-1.71. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1538 advisory. A race condition flaw was found in Go. The incoming requests body weren't closed after the handler panic and as a consequence th...

Amazon Linux AMI : openssl (ALAS-2021-1541)

The version of openssl installed on the remote host is prior to 1.0.2k-16.154. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1541 advisory. It was found that openssl assumed ASN.1 strings to be NUL terminated. A malicious actor may be able to force an application in...

Amazon Linux AMI : kernel (ALAS-2021-1539)

The version of kernel installed on the remote host is prior to 4.14.248-129.473. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1539 advisory. A flaw was found in the Linux kernel. When reusing a socket with an attached dccpshctxccid as a listener, the socke...

Amazon Linux AMI : docker (ALAS-2021-1537)

The version of docker installed on the remote host is prior to 20.10.7-3.71. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1537 advisory. A bug was found in Moby Docker Engine where attempting to copy files using docker cp into a specially- crafted containe...

Amazon Linux AMI : containerd (ALAS-2021-1540)

The version of containerd installed on the remote host is prior to 1.4.6-3.9. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1540 advisory. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions,...

Important: ca-certificates

Issue Overview: Update of ca-certificates to version 2021.2.50-72.amzn2.0.1 addresses the expiring IdentTrust DST Root CA X3, which affected some Let's Encrypt TLS certificates. The effect of the expiring certificate would be an inability of OpenSSL to validate impacted certificates issued by Let...

Amazon Linux 2 : kernel (ALAS-2021-1699)

The version of kernel installed on the remote host is prior to 4.14.243-185.433. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1699 advisory. A flaw was found in the Linux kernel's KVM implementation, where improper handing of the VMIO|VMPFNMAP VMAs in KVM bypasses...

Important: kernel-livepatch-4.14.232-177.418

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-4.14.232-177.418 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-4.14.232-177.418 or yum update --advisory ALAS2LIVEPATCH-2021-060 to update your system. New...

Important: kernel-livepatch-4.14.241-184.433

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-4.14.241-184.433 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-4.14.241-184.433 or yum update --advisory ALAS2LIVEPATCH-2021-063 to update your system. New...

Important: kernel-livepatch-4.14.243-185.433

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-4.14.243-185.433 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-4.14.243-185.433 or yum update --advisory ALAS2LIVEPATCH-2021-062 to update your system. New...

Amazon Linux 2 : php-pear (ALAS-2021-1708)

The version of php-pear installed on the remote host is prior to 1.10.12-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1708 advisory. In ArchiveTar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than...

Amazon Linux 2 : openldap (ALAS-2021-1707)

The version of openldap installed on the remote host is prior to 2.4.44-23. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1707 advisory. A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resultin...

Amazon Linux 2 : gcc10-binutils (ALAS-2021-1702)

The version of gcc10-binutils installed on the remote host is prior to 2.35-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1702 advisory. 2024-01-19: CVE-2021-20284 was added to this advisory. An issue was discovered in the Binary File Descriptor BFD...

Amazon Linux 2 : ntp (ALAS-2021-1706)

The version of ntp installed on the remote host is prior to 4.2.8p15-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1706 advisory. The monlist feature in ntprequest.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service traffic...

Amazon Linux 2 : glibc (ALAS-2021-1703)

The version of glibc installed on the remote host is prior to 2.26-53. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1703 advisory. An integer overflow flaw was found in glibc that may result in reading of arbitrary memory when wordexp is used with a specially...

Amazon Linux 2 : exiv2 (ALAS-2021-1701)

The version of exiv2 installed on the remote host is prior to 0.27.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1701 advisory. A flaw was found in exiv2. A flawed bounds checking in the jp2Image.cpp:doWriteMetadata function leads to a heap-based buffer...