Amazon Linux 2 : libpq (ALASPOSTGRESQL12-2023-003)

The version of libpq installed on the remote host is prior to 12.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL12-2023-003 advisory. 2024-02-29: CVE-2021-23222 was added to this advisory. A man-in-the-middle attacker can inject false responses to...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2023-006)

The version of tomcat installed on the remote host is prior to 9.0.54-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2023-006 advisory. A memory leak flaw was found in Apache Tomcat, where an HTTP upgrade connection does not release for WebSocket connections on...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-003)

The version of tomcat installed on the remote host is prior to 8.5.79-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2023-003 advisory. A flaw was found in the Apache Tomcat package. An example web application did not filter the form authentication example,...

Amazon Linux 2 : python38 (ALASPYTHON3.8-2023-008)

The version of python38 installed on the remote host is prior to 3.8.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PYTHON3.8-2023-008 advisory. A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite...

Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2023-001)

The version of haproxy2 installed on the remote host is prior to 2.2.17-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2HAPROXY2-2023-001 advisory. A flaw was found in the way HAProxy processed HTTP responses containing the Set-Cookie2 header. This flaw could allow an...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL12-2023-005)

The version of postgresql installed on the remote host is prior to 12.15-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL12-2023-005 advisory. IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or...

Amazon Linux 2 : ruby (ALASRUBY3.0-2023-003)

The version of ruby installed on the remote host is prior to 3.0.3-154. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2RUBY3.0-2023-003 advisory. CGI.escapehtml in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a...

Amazon Linux 2 : mariadb, --advisory ALAS2MARIADB10.5-2023-003 (ALASMARIADB10.5-2023-003)

The version of mariadb installed on the remote host is prior to 10.5.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2MARIADB10.5-2023-003 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are...

Amazon Linux 2 : squid (ALASSQUID4-2023-008)

The version of squid installed on the remote host is prior to 4.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2SQUID4-2023-008 advisory. A flaw was found in Squid through version 4.7. When handling the tag esi:when, when ESI is enabled, Squid calls the...

Amazon Linux 2 : mariadb (ALASMARIADB10.5-2023-002)

The version of mariadb installed on the remote host is prior to 10.5.10-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2MARIADB10.5-2023-002 advisory. MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepareinplaceaddvirtual at...

Amazon Linux 2 : squid (ALASSQUID4-2023-007)

The version of squid installed on the remote host is prior to 4.10-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2SQUID4-2023-007 advisory. An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTT...

Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2023-006)

The version of haproxy2 installed on the remote host is prior to 2.1.4-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2HAPROXY2-2023-006 advisory. In hpackdhtinsert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-012)

The version of tomcat installed on the remote host is prior to 8.5.51-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-012 advisory. The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a...

Amazon Linux 2 : redis (ALASREDIS6-2023-003)

The version of redis installed on the remote host is prior to 6.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2023-003 advisory. A flaw was found in the Redis database where Lua scripts can be manipulated to overcome ACL rules. This flaw allows an...

Amazon Linux 2 : golang (ALASGOLANG1.19-2023-002)

The version of golang installed on the remote host is prior to 1.19.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2GOLANG1.19-2023-002 advisory. An out of bounds read vulnerability was found in debug/macho of the Go standard library. When using the debug/mac...

Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2023-007)

The version of haproxy2 installed on the remote host is prior to 2.2.17-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2HAPROXY2-2023-007 advisory. HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7...

Amazon Linux 2 : mariadb (ALASMARIADB10.5-2023-004)

The version of mariadb installed on the remote host is prior to 10.5.10-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2MARIADB10.5-2023-004 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-011)

The version of tomcat installed on the remote host is prior to 8.5.58-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2023-011 advisory. If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the...

Amazon Linux 2 : squid (ALASSQUID4-2023-004)

The version of squid installed on the remote host is prior to 4.15-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2SQUID4-2023-004 advisory. Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an...

Amazon Linux 2 : python38 (ALASPYTHON3.8-2023-004)

The version of python38 installed on the remote host is prior to 3.8.15-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PYTHON3.8-2023-004 advisory. The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that...