MAL-2024-1791 Malicious code in aws-ecs-devops-using-aws-cdk (npm)

--- -= Per source details. Do not edit below this line.=-...

Important: ecs-init

Issue Overview: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-037)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.29.5.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-037 advisory. Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2024-647)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-647 advisory. 2024-07-17: CVE-2024-30255 was added to this advisory. Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a serve...

PT-2024-9646 · Dell · Dell Ecs

Name of the Vulnerable Software and Affected Versions: Dell ECS versions prior to 3.8.0 Description: The issue is related to a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that lead to sensitive...

CVE-2021-47536

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix wrong listdel in smclgrcleanupearly smclgrcleanupearly meant to delete the link group from the link group list, but it deleted the list head by mistake. This may cause memory corruption since we didn't remove the rea...

Medium: ecs-init

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Medium: ecs-init

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-619)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-619 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can...

Important: ecs-init

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init --releasever 2023.4.20240513 to update your system. New Packages: aarch64: ecs-init-1.70.1-1.amzn2023.aarch64 src: ...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-620)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-620 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has no...

Important: ecs-init

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init --releasever 2023.4.20240513 or dnf update --advisory ALAS2023-2024-620 --releasever 2023.4.20240513 to update your system. More informati...

Elevating Security: Qualys Unveils First Solution for Scanning AWS Bottlerocket in Amazon EKS and Amazon ECS

With this new offering, Qualys establishes itself as the first and only vendor solution with the unique ability to scan AWS Bottlerocket instances directly using the Qualys Cloud Agent and TotalCloud Agent-less Snapshot-Based Scan. This innovative capability empowers organizations to...

DELL ECS Connection Manager 安全漏洞

DELL ECS Connection Manager is a software from Dell USA for managing enterprise cloud storage. A security vulnerability exists in DELL ECS Connection Manager that originates from allowing an unauthenticated attacker to access computers on the same network in an HA or cluster group via an IP...

DELL ECS Connection Manager 安全漏洞

DELL ECS Connection Manager is a software for managing enterprise cloud storage from Dell DELL USA. A security vulnerability exists in DELL ECS Connection Manager that stems from the use of a reversible password encryption algorithm that allows an attacker to decrypt passwords...

Malicious code in ecs-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 308d5a6fa5eb0973b0ff8290c321ac60685b686f42543a7a09b16a5fe56a7457 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1287 Malicious code in ecs-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 308d5a6fa5eb0973b0ff8290c321ac60685b686f42543a7a09b16a5fe56a7457 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-5195 · Dell · Dell Ecs

Name of the Vulnerable Software and Affected Versions: Dell ECS versions prior to 3.8.1 Description: The issue is related to insufficient access control in the Dell EMC Elastic Cloud Storage ECS platform, which can be exploited by a remote attacker to elevate their privileges. A high-privileged...

PT-2025-16951 · Dell · Dell Ecs

Name of the Vulnerable Software and Affected Versions: Dell ECS versions 3.8.1.4 and prior Description: The issue is related to an Improper Certificate Validation, which could be exploited by an unauthenticated attacker with adjacent network access, potentially leading to information disclosure...

PT-2025-16950 · Dell · Dell Ecs

Name of the Vulnerable Software and Affected Versions: Dell ECS versions 3.8.1.4 and prior Description: The issue is related to an Improper Input Validation, which could be exploited by a low-privileged attacker with remote access, potentially leading to code execution. Recommendations: For Dell...