Medium: python-pip

Issue Overview: When installing a package from a Mercurial VCS URL ie "pip install hg+..." with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call ie "--config". Controlling the Mercurial configuration can modify how...

Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2023-453)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-453 advisory. An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of...

Amazon Linux 2023 : amazon-efs-utils (ALAS2023-2023-437)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-437 advisory. efs-utils is a set of Utilities for Amazon Elastic File System EFS. A potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below. When using TLS to...

Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2023-433)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-433 advisory. Out-of-bounds Read vulnerability in modmacro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. CVE-2023-31122 A flaw was found in httpd. This flaw allows an attacker...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-431)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-431 advisory. Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function gagrowinner in in the file src/alloc.c at line 748, which is freed in the file...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-436)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-436 advisory. 2024-03-27: CVE-2023-23908 was added to this advisory. An issue was found in redundant REX instruction prefix values affecting third generation Intel Xeon Scalable Icelake processors. The issue...

Amazon Linux 2023 : ecs-init (ALAS2023-2023-435)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-435 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-430)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-430 advisory. An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the VC handler and instruction emulati...

Amazon Linux 2023 : python3-twisted, python3-twisted+tls (ALAS2023-2023-432)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-432 advisory. Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously...

Medium: amazon-efs-utils

Issue Overview: efs-utils is a set of Utilities for Amazon Elastic File System EFS. A potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below. When using TLS to mount file systems, the mount helper allocates a local port for stunnel to...

Medium: python-twisted

Issue Overview: Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by...

Amazon Linux 2023 : open-vm-tools, open-vm-tools-desktop, open-vm-tools-devel (ALAS2023-2023-423)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-423 advisory. VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-...

Amazon Linux 2023 : compat-libpthread-nonshared, glibc, glibc-all-langpacks (ALAS2023-2023-407)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-407 advisory. A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash. CVE-2023-5156 Tenable has extracted the...

Amazon Linux 2023 : vorbis-tools (ALAS2023-2023-414)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-414 advisory. Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files. CVE-2023-43361...

Amazon Linux 2023 : minizip-compat, minizip-compat-devel, zlib (ALAS2023-2023-410)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-410 advisory. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-403)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-403 advisory. NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960. CVE-2023-5441 Use After Free in GitHub repository vim/vim prior to v9.0.2010...

Amazon Linux 2023 : plexus-archiver, plexus-archiver-javadoc (ALAS2023-2023-421)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-421 advisory. Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified Archiver/UnArchiver API. Prior to version 4.8.0, using AbstractUnArchiver for...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-422)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-422 advisory. 2024-07-03: CVE-2023-52522 was added to this advisory. 2024-07-03: CVE-2023-52559 was added to this advisory. 2024-07-03: CVE-2023-52523 was added to this advisory. 2024-06-06: CVE-2023-52481 w...

Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2023-408)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-408 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-405)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-405 advisory. RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file CVE-2023-5371 Tenable has extracted the preceding...