Amazon Linux 2 : libpq (ALASPOSTGRESQL12-2023-003)

The version of libpq installed on the remote host is prior to 12.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL12-2023-003 advisory. 2024-02-29: CVE-2021-23222 was added to this advisory. A man-in-the-middle attacker can inject false responses to...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL12-2023-002)

The version of postgresql installed on the remote host is prior to 12.11-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL12-2023-002 advisory. 2024-08-28: CVE-2021-3677 was added to this advisory. 2024-02-29: CVE-2021-23222 was added to this advisory....

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-014)

The version of tomcat installed on the remote host is prior to 8.5.40-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2023-014 advisory. The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided da...

Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2023-002)

The version of haproxy2 installed on the remote host is prior to 2.2.17-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2HAPROXY2-2023-002 advisory. An out-of-bounds read in dnsvalidatednsresponse in dns.c was discovered in HAProxy through 1.8.14. Due to a missi...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL11-2023-001)

The version of postgresql installed on the remote host is prior to 11.20-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL11-2023-001 advisory. This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL14-2023-001)

The version of postgresql installed on the remote host is prior to 14.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL14-2023-001 advisory. postgresql: Client memory disclosure when connecting with Kerberos to modified server CVE-2022-41862 This...

Amazon Linux 2 : ruby (ALASRUBY2.6-2023-007)

The version of ruby installed on the remote host is prior to 2.6.6-125. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2RUBY2.6-2023-007 advisory. jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput function does not...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-015)

The version of tomcat installed on the remote host is prior to 8.5.93-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2023-015 advisory. URL Redirection to Untrusted Site 'Open Redirect' vulnerability in FORM authentication feature Apache Tomcat.This issue...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2023-009)

The version of tomcat installed on the remote host is prior to 9.0.80-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2023-009 advisory. URL Redirection to Untrusted Site 'Open Redirect' vulnerability in FORM authentication feature Apache Tomcat.This issue affec...

Amazon Linux 2 : redis (ALASREDIS6-2023-003)

The version of redis installed on the remote host is prior to 6.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2023-003 advisory. A flaw was found in the Redis database where Lua scripts can be manipulated to overcome ACL rules. This flaw allows an...

Amazon Linux 2 : golang (ALASGOLANG1.19-2023-002)

The version of golang installed on the remote host is prior to 1.19.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2GOLANG1.19-2023-002 advisory. An out of bounds read vulnerability was found in debug/macho of the Go standard library. When using the debug/mac...

Amazon Linux 2 : redis (ALASREDIS6-2023-001)

The version of redis installed on the remote host is prior to 6.2.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2023-001 advisory. Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted SETRANGE and SORTR...

Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2023-007)

The version of haproxy2 installed on the remote host is prior to 2.2.17-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2HAPROXY2-2023-007 advisory. HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7...

Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2023-006)

The version of haproxy2 installed on the remote host is prior to 2.1.4-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2HAPROXY2-2023-006 advisory. In hpackdhtinsert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL11-2023-003)

The version of postgresql installed on the remote host is prior to 11.12-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL11-2023-003 advisory. A flaw was found in postgresql. While modifying certain SQL array values, missing bounds checks let...

Amazon Linux 2 : python38-setuptools (ALASPYTHON3.8-2023-003)

The version of python38-setuptools installed on the remote host is prior to 38.4.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2PYTHON3.8-2023-003 advisory. Python Packaging Authority PyPA setuptools before 65.5.1 allows remote attackers to cause a denial of service...

Amazon Linux 2 : mariadb, --advisory ALAS2MARIADB10.5-2023-003 (ALASMARIADB10.5-2023-003)

The version of mariadb installed on the remote host is prior to 10.5.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2MARIADB10.5-2023-003 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2023-002)

The version of postgresql installed on the remote host is prior to 13.7-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL13-2023-002 advisory. 2024-08-28: CVE-2021-3677 was added to this advisory. 2024-02-29: CVE-2021-23222 was added to this advisory. ...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL11-2023-002)

The version of postgresql installed on the remote host is prior to 11.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL11-2023-002 advisory. A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL14-2023-002)

The version of postgresql installed on the remote host is prior to 14.3-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2023-002 advisory. A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is...