Amazon Linux 2 : java-17-amazon-corretto, java-11-amazon-corretto, java-1.8.0-openjdk, java-1.7.0-openjdk (ALAS-2021-1731)

The version of java-1.7.0-openjdk installed on the remote host is prior to 1.7.0.261-2.6.22.2. The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.312.b07-1. The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.13+8-2. The version of...

Critical: java-1.8.0-openjdk, java-1.7.0-openjdk, java-1.6.0-openjdk

Issue Overview: No versions of an Amazon Linux Java Virtual Machine JVM are affected by CVE-2021-44228 or CVE-2021-45046. However, if customers load a log4j version that is affected by CVE-2021-44228 or CVE-2021-45046 into an Amazon Linux JVM, it will introduce the issues identified in...

Critical: java-17-amazon-corretto, java-11-amazon-corretto, java-1.8.0-openjdk, java-1.7.0-openjdk

Issue Overview: No versions of an Amazon Linux Java Virtual Machine JVM are affected by CVE-2021-44228 or CVE-2021-45046. However, if customers load a log4j version that is affected by CVE-2021-44228 or CVE-2021-45046 into an Amazon Linux JVM, it will introduce the issues identified in...

Critical: java-1.8.0-amazon-corretto

Issue Overview: No versions of an Amazon Linux Java Virtual Machine JVM are affected by CVE-2021-44228 or CVE-2021-45046. However, if customers load a log4j version that is affected by CVE-2021-44228 or CVE-2021-45046 into an Amazon Linux JVM, it will introduce the issues identified in...

Critical: java-11-openjdk

Issue Overview: No versions of an Amazon Linux Java Virtual Machine JVM are affected by CVE-2021-44228 or CVE-2021-45046. However, if customers load a log4j version that is affected by CVE-2021-44228 or CVE-2021-45046 into an Amazon Linux JVM, it will introduce the issues identified in...

Amazon Linux AMI : java-1.8.0-openjdk, java-1.7.0-openjdk, java-1.6.0-openjdk (ALAS-2021-1553)

The version of java-1.6.0-openjdk installed on the remote host is prior to 1.6.0.41-1.13.13.1.78. The version of java-1.7.0-openjdk installed on the remote host is prior to 1.7.0.261-2.6.22.1.84. The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.312.b07-0.66. It is,...

Amazon Linux 2 : aws-kinesis-agent (ALAS-2021-1730)

The version of aws-kinesis-agent installed on the remote host is prior to 2.0.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1730 advisory. Amazon Kinesis Agent versions within Amazon Linux 2 AL2 prior to aws-kinesis-agent-2.0.4-1 included a version of...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2021-1726)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.312.b07-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1726 advisory. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component:...

Amazon Linux 2 : curl (ALAS-2021-1724)

The version of curl installed on the remote host is prior to 7.79.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1724 advisory. A flaw was found in libcurl. When sending data to an MQTT server could in some situations lead to libcurl using already free...

Amazon Linux 2 : vim (ALAS-2021-1728)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1728 advisory. 2024-05-09: CVE-2020-20703 was added to this advisory. Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter. CVE-2020-20703...

Amazon Linux 2 : kernel (ALAS-2021-1727)

The version of kernel installed on the remote host is prior to 4.14.256-197.484. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1727 advisory. 2024-08-14: CVE-2021-47203 was added to this advisory. 2024-08-14: CVE-2021-47184 was added to this advisory...

Low: 389-ds-base

Issue Overview: A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose...

Amazon Linux 2 : 389-ds-base (ALAS-2021-1723)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1723 advisory. A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then...

Amazon Linux 2 : cyrus-imapd (ALAS-2021-1725)

The version of cyrus-imapd installed on the remote host is prior to 2.4.22-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1725 advisory. A flaw was found in cyrus-imapd. A bad string hashing algorithm used in internal hash tables allows user inputs to be stored i...

Amazon Linux 2 : nss, nss-util, nss-softokn, nspr (ALAS-2021-1722)

The version of nspr installed on the remote host is prior to 4.32.0-1. The version of nss installed on the remote host is prior to 3.67.0-4. The version of nss-softokn installed on the remote host is prior to 3.67.0-3. The version of nss- util installed on the remote host is prior to 3.67.0-1. It...

Amazon Linux AMI : nss (ALAS-2021-1552)

The version of nss installed on the remote host is prior to 3.53.1-7.87. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1552 advisory. NSS Network Security Services up to and including 3.73 is vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS...

Important: docker

Issue Overview: A flaw was discovered in the API endpoint behind the 'docker cp' command. The endpoint is vulnerable to a Time Of Check to Time Of Use TOCTOU vulnerability in the way it handles symbolic links inside a container. An attacker who has compromised an existing container can cause...

Medium: docker

Issue Overview: A flaw was found in the userns-remap feature of Docker. The root user in the remapped namespace can modify files under /var/lib/docker/, leading to possible privilege escalation to the root user in the host. The highest threat from this vulnerability is to data integrity...

Medium: containerd, docker

Issue Overview: In the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header. Versions of Moby Docker Engine prior to 20.10.11 and versions of...

Medium: docker

Issue Overview: A flaw was found in moby. Moby buildkit calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call. CVE-2020-27534 Affected Packages: docker Note: This advisory is applicable to Amazon Linux 2 -...