Amazon Linux 2 : tomcat (ALASTOMCAT9-2023-007)

The version of tomcat installed on the remote host is prior to 9.0.50-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2023-007 advisory. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding...

Amazon Linux 2 : squid (ALASSQUID4-2023-009)

The version of squid installed on the remote host is prior to 4.15-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2SQUID4-2023-009 advisory. An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can...

Amazon Linux 2 : golang (ALASGOLANG1.19-2023-002)

The version of golang installed on the remote host is prior to 1.19.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2GOLANG1.19-2023-002 advisory. An out of bounds read vulnerability was found in debug/macho of the Go standard library. When using the debug/mac...

Amazon Linux 2 : redis (ALASREDIS6-2023-003)

The version of redis installed on the remote host is prior to 6.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2023-003 advisory. A flaw was found in the Redis database where Lua scripts can be manipulated to overcome ACL rules. This flaw allows an...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2023-008)

The version of tomcat installed on the remote host is prior to 9.0.73-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2023-008 advisory. A privilege escalation flaw was found in Tomcat when the JMX Remote Lifecycle Listener was enabled. A local attacker...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-012)

The version of tomcat installed on the remote host is prior to 8.5.51-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-012 advisory. The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a...

Amazon Linux 2 : ruby (ALASRUBY3.0-2023-003)

The version of ruby installed on the remote host is prior to 3.0.3-154. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2RUBY3.0-2023-003 advisory. CGI.escapehtml in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a...

Scylla Security Breach

Scylla is a ScyllaDB open source real-time big data database compatible with Apache Cassandra and Amazon DynamoDB APIs. Scylla has a security vulnerability that stems from allowing an attacker with CREATE access to elevate to higher privileges...

Amazon Linux 2 : python-paramiko (ALASANSIBLE2-2023-002)

It is, therefore, affected by a vulnerability as referenced in the ALAS2ANSIBLE2-2023-002 advisory. In Paramiko before 2.10.1, a race condition between creation and chmod in the writeprivatekeyfile function could allow unauthorized information disclosure. CVE-2022-24302 Tenable has extracted the...

Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2023-005 (ALASTOMCAT9-2023-005)

The version of tomcat installed on the remote host is prior to 9.0.65-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2023-005 advisory. The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2023-003)

The version of postgresql installed on the remote host is prior to 13.3-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL13-2023-003 advisory. A flaw was found in postgresql. While modifying certain SQL array values, missing bounds checks let...

Amazon Linux 2 : microvm-kernel (ALASMICROVM-KERNEL-4.14-2023-001)

The version of microvm-kernel installed on the remote host is prior to 4.14.252-207.481. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2MICROVM-KERNEL-4.14-2023-001 advisory. A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to b...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL12-2023-004)

The version of postgresql installed on the remote host is prior to 12.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL12-2023-004 advisory. A flaw was found in postgresql. While modifying certain SQL array values, missing bounds checks let...

Amazon Linux 2 : redis (ALASREDIS6-2023-008)

The version of redis installed on the remote host is prior to 6.2.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2023-008 advisory. Redis is an open source BSD licensed, in-memory data structure store, used as a database, cache, and message broker. An...

Amazon Linux 2 : redis (ALASREDIS6-2023-002)

The version of redis installed on the remote host is prior to 6.2.13-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2REDIS6-2023-002 advisory. A heap-based buffer overflow flaw was found in Redis. This flaw allows an attacker to trick an authenticated user into executin...

Amazon Linux 2 : nginx (ALASNGINX1-2023-002)

The version of nginx installed on the remote host is prior to 1.20.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2023-002 advisory. ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but...

Amazon Linux 2 : libreoffice (ALASLIBREOFFICE-2023-001)

The version of libreoffice installed on the remote host is prior to 5.3.6.1-21. It is, therefore, affected by a vulnerability as referenced in the ALAS2LIBREOFFICE-2023-001 advisory. A flaw was found in the Libreoffice package. An attacker can craft an odb containing a database/script file with a...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-013)

The version of tomcat installed on the remote host is prior to 8.5.87-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-013 advisory. A privilege escalation flaw was found in Tomcat when the JMX Remote Lifecycle Listener was enabled. A local attack...

Amazon Linux 2 : ruby (ALASRUBY2.6-2023-002)

The version of ruby installed on the remote host is prior to 2.6.9-129. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2RUBY2.6-2023-002 advisory. A flaw was found in ruby, where the date object was found to be vulnerable to a regular expression denial of service...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2023-001)

The version of postgresql installed on the remote host is prior to 13.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL13-2023-001 advisory. postgresql: Client memory disclosure when connecting with Kerberos to modified server CVE-2022-41862 This...