Amazon Linux 2 : golang (ALAS-2023-2186)

The version of golang installed on the remote host is prior to 1.20.6-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2186 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional...

Amazon Linux 2 : webkitgtk4 (ALAS-2023-2177)

The version of webkitgtk4 installed on the remote host is prior to 2.38.5-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2177 advisory. A vulnerability was found in webkitgtk. This issue occurs when processing web content, which may lead to arbitrary code...

Amazon Linux AMI : ImageMagick (ALAS-2023-1791)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1.27. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1791 advisory. A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel function in quantum- private.h. This issue ma...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2023-291)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-291 advisory. A heap-based buffer overflow flaw was found in Redis. This flaw allows an attacker to trick an authenticated user into executing a specially crafted Lua script in Redis. This attack triggers a heap...

Amazon Linux 2023 : libnghttp2, libnghttp2-devel, nghttp2 (ALAS2023-2023-278)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-278 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY fram...

Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2023-005)

The version of java-11-openjdk installed on the remote host is prior to 11.0.20.0.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2JAVA-OPENJDK11-2023-005 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-050)

The version of kernel installed on the remote host is prior to 5.4.250-166.369. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-050 advisory. An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to...

Amazon Linux 2 : linux-firmware (ALAS-2023-2190)

The version of linux-firmware installed on the remote host is prior to 20200421-81.git78c0348. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2190 advisory. An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially...

Amazon Linux 2 : qemu (ALAS-2023-2191)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2191 advisory. There is a vulnerability in the lsi53c895a device which affects the latest version of qemu. The carefully designed PoC can repeatedly...

Amazon Linux 2023 : iperf3, iperf3-devel (ALAS2023-2023-274)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-274 advisory. iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. CVE-2023-38403 Tenable has extracted the preceding description block directly from the tested...

Amazon Linux 2023 : yajl, yajl-devel (ALAS2023-2023-279)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-279 advisory. There's a memory leak in yajl 2.1.0 with use of yajltreeparse function. which will cause out-of-memory in server and cause crash. CVE-2023-33460 Tenable has extracted the preceding description block...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-285)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-285 advisory. 2023-08-31: CVE-2023-3611 was removed from this advisory. 2023-08-31: CVE-2023-3776 was removed from this advisory. 2023-08-31: The severity of this advisory was changed from important to mediu...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2023-1798)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.372.b07-1.76. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1798 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component:...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-287)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-287 advisory. A Gather Data Sampling GDS transient execution side-channel vulnerability was found affecting certain Intel processors. This issue may allow a local attacker using gather instruction load from memory to...

Amazon Linux 2 : cups (ALAS-2023-2184)

The version of cups installed on the remote host is prior to 1.6.3-51. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2184 advisory. OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a...

Amazon Linux AMI : GraphicsMagick (ALAS-2023-1799)

The version of GraphicsMagick installed on the remote host is prior to 1.3.32-1.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1799 advisory. In GraphicsMagick, a heap buffer overflow was found when parsing MIFF. CVE-2022-1270 Tenable has extracted the preceding...

Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2023-025)

The version of runc installed on the remote host is prior to 1.1.7-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2023-025 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject...

Amazon Linux 2 : ca-certificates (ALAS-2023-2203)

The version of ca-certificates installed on the remote host is prior to 2021.2.50-72. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2203 advisory. An initial fix in Amazon Linux ca-certificates package relating to CVE-2022-23491 did not properly remove root...

Amazon Linux AMI : python-ecdsa (ALAS-2023-1800)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1800 advisory. An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions or no exceptions at all, which could...

Amazon Linux 2 : nerdctl (ALAS-2023-2193)

The version of nerdctl installed on the remote host is prior to 1.1.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2193 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the...