CVE-2023-5680

If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. This issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and...

Medium: ecs-init

Issue Overview: Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. CVE-2023-3978 Affected Packages: ecs-init Note: This advisory is applicable to Amazon Linux 2 - Ecs Extra. Visit this page to...

Amazon Linux 2 : ecs-init (ALASECS-2024-032)

The version of ecs-init installed on the remote host is prior to 1.75.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2024-032 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject...

Amazon Linux 2 : ecs-init (ALASECS-2024-031)

The version of ecs-init installed on the remote host is prior to 1.79.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2024-031 advisory. Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This...

Important: ecs-init

Issue Overview: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

Medium: ecs-init

Issue Overview: Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. CVE-2023-3978 Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init --releasever 2023.3.20240108 to update you...

Medium: ecs-init

Issue Overview: Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. CVE-2023-3978 Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init --releasever 2023.3.20240108 or dnf update...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-480)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-480 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-476)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-476 advisory. Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. CVE-2023-3978 Tenable has extracted the precedi...

Amazon Linux 2 : ecs-init (ALASECS-2023-020)

The version of ecs-init installed on the remote host is prior to 1.79.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-020 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

Medium: containerd

Issue Overview: A bug was found in containerd where containers launched through containerd's CRI implementation with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on...

Medium: containerd

Issue Overview: The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Image Specification, the manifest and index documents were not self-describing and documents with a single digest could be interpreted as either a manife...

Amazon Linux 2023 : ecs-init (ALAS2023-2023-435)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-435 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

Low: ecs-init

Issue Overview: No CVE associated with this advisory Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init --releasever 2023.2.20231113 or dnf update --advisory ALAS2023-2023-434 --releasever 2023.2.20231113 to update your system. More information on how to update your system can ...

Important: ecs-init

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init...

SQL Injection Vulnerability in Intelligent Logistics Unattended System of Taiyuan ECS Software Technology Co. Ltd (CNVD-2023-99600)

Intelligent logistics unattended system is an intelligent information platform for the unified control of raw material procurement, finished product sales and in-plant logistics for process manufacturing enterprises. There is a SQL injection vulnerability in the Intelligent Logistics Unattended...

SQL Injection Vulnerability in ECS Unattended Intelligent Logistics System of Taiyuan ECS Software Technology Company Limited (CNVD-2023-96352)

Taiyuan ECS Software Technology Co., Ltd. is a software developer dedicated to the field of coal and coke in China. Taiyuan ECS Software Technology Co., Ltd ECS Unattended Intelligent Logistics System suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2023-420)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-420 advisory. An issue was found in libcurl which allows cookies to be inserted into a running program if specific conditions are met. The libcurl provided function, curleasyduphandle, is used to duplicate t...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2023-016)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.27.2.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-016 advisory. An issue was found in libcurl which allows cookies to be inserted into a running program if specif...

Amazon Linux 2 : ecs-init (ALASECS-2023-009)

The version of ecs-init installed on the remote host is prior to 1.76.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-009 advisory. No CVE was issued for this update. Tenable has extracted the preceding description block directly from the tested product...