Amazon Linux 2 : nginx (ALASNGINX1-2023-005)

The version of nginx installed on the remote host is prior to 1.20.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2023-005 advisory. The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, befor...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL11-2023-004)

The version of postgresql installed on the remote host is prior to 11.20-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL11-2023-004 advisory. IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-010)

The version of tomcat installed on the remote host is prior to 8.5.60-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-010 advisory. While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and...

Amazon Linux 2 : libtommath (ALASANSIBLE2-2023-010)

The version of libtommath installed on the remote host is prior to 1.0.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2ANSIBLE2-2023-010 advisory. Integer Overflow vulnerability in mpgrow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9,...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-007)

The version of firefox installed on the remote host is prior to 102.8.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-007 advisory. firefox-esr , thunderbird and nss only are affected by this package. CVE-2023-0767 The Mozilla Foundation Security...

Amazon Linux 2 : djvulibre (ALASMATE-DESKTOP1.X-2023-001)

The version of djvulibre installed on the remote host is prior to 3.5.27-30. It is, therefore, affected by a vulnerability as referenced in the ALAS2MATE-DESKTOP1.X-2023-001 advisory. An out-of-bounds write vulnerability was found in DjVuLibre in DJVU::DjVuTXT::decode in DjVuText.cpp via a crafte...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-001)

The version of firefox installed on the remote host is prior to 102.13.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-001 advisory. An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This...

Amazon Linux 2 : python38 (ALASPYTHON3.8-2023-005)

The version of python38 installed on the remote host is prior to 3.8.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PYTHON3.8-2023-005 advisory. A flaw was found in python. A stack-based buffer overflow was discovered in the ctypes module provided within Python...

Amazon Linux 2 : ruby (ALASRUBY2.6-2023-001)

The version of ruby installed on the remote host is prior to 2.6.10-129. It is, therefore, affected by a vulnerability as referenced in the ALAS2RUBY2.6-2023-001 advisory. A buffer overrun vulnerability was found in Ruby. The issue occurs in a conversion algorithm from a String to a Float that...

Amazon Linux 2 : mariadb (ALASMARIADB10.5-2023-001)

The version of mariadb installed on the remote host is prior to 10.5.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2MARIADB10.5-2023-001 advisory. A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, a...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-004)

The version of tomcat installed on the remote host is prior to 8.5.75-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2023-004 advisory. The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to...

Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT8.5-2023-009 (ALASTOMCAT8.5-2023-009)

The version of tomcat installed on the remote host is prior to 8.5.63-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-009 advisory. A flaw was found in Apache Tomcat. When responding to new h2c connection requests, Apache Tomcat could duplicate...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-005)

The version of tomcat installed on the remote host is prior to 8.5.79-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-005 advisory. A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux,...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2023-004)

The version of tomcat installed on the remote host is prior to 9.0.65-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2023-004 advisory. A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux, transitively...

Important: tomcat

Issue Overview: The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a reques...

Medium: ruby

Issue Overview: A flaw was found in ruby, where the date object was found to be vulnerable to a regular expression denial of service ReDoS during the parsing of dates. This flaw allows an attacker to hang a ruby application by providing a specially crafted date string. The highest threat to this...

Medium: haproxy2

Issue Overview: The HAProxy Github issue describes this vulnerability as follows: Crash SEGV in httpwaitforresponse in 2.2.19, 2.2.24, and 2.2.26 because sl start line variable is NULL. CVE-2023-0056 Affected Packages: haproxy2 Note: This advisory is applicable to Amazon Linux 2 - Haproxy2 Extra...

Important: ruby

Issue Overview: The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object. CVE-2021-33621 Affected Packages:...

Medium: tomcat

Issue Overview: A flaw was found in the Apache Tomcat package. An example web application did not filter the form authentication example, exposing a Cross-site scripting XSS vulnerability. CVE-2022-34305 Affected Packages: tomcat Note: This advisory is applicable to Amazon Linux 2 - Tomcat8.5...

Important: postgresql

Issue Overview: postgresql: Client memory disclosure when connecting with Kerberos to modified server CVE-2022-41862 This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. Database owners have that right by default, and explicit grant...