Amazon Linux 2023 : mod_security, mod_security-mlogc (ALAS2023-2025-1157)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1157 advisory. ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response's Content-Type, whi...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1169)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1169 advisory. In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in opencacheddir with lease breaks CVE-2025-37954 In the Linux kernel, the following vulnerability h...

Medium: perl-Authen-SASL

Issue Overview: Authen::SASL::Perl::DIGESTMD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely. The cnonce client nonce is generated from an MD5 hash of the PID, the epoch time and the built-in rand function. The PID will come from a small set of numbers, and the epoch time m...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2025-1162)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1162 advisory. There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommen...

Important: kernel-livepatch-6.12.25-32.101

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-free during router port configuration CVE-2025-38248 Affected Packages: kernel-livepatch-6.12.25-32.101 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: golang

Issue Overview: os/exec: LookPath may return unexpected paths. If the PATH environment variable contains paths which are executables rather than just directories, passing certain strings to LookPath "", ".", and "..", can result in the binaries listed in the PATH being unexpectedly returned...

Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2025-1155)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1155 advisory. The privatekeyfromfile uses an uninitialized variable under certainconditions, such as if the file specified by the filename argument doesn'texist. This causes the code to return an invalid...

Medium: libcap

Issue Overview: Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. CVE-2025-22874 Proxy-Authorization and Proxy-Authenticate headers...

Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2025-1147)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1147 advisory. There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error,...

Amazon Linux 2023 : captree, libcap, libcap-devel (ALAS2023-2025-1141)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1141 advisory. Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which a...

Amazon Linux 2023 : mod_security, mod_security-mlogc (ALAS2023-2025-1139)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1139 advisory. ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2025-1135)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1135 advisory. There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error,...

Amazon Linux 2023 : cni-plugins (ALAS2023-2025-1143)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1143 advisory. Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which a...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2025-1138)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1138 advisory. Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim's tar.vim plugin can allow overwriting of arbitrary files when opening specially craft...

Low: kernel

Issue Overview: No CVE associated with this advisory Affected Packages: kernel Issue Correction: Run dnf update kernel --releasever 2023.8.20250808 or dnf update --advisory ALAS2023-2025-1128 --releasever 2023.8.20250808 to update your system. More information on how to update your system can be...

Important: golang

Issue Overview: cmd/go: unexpected command execution in untrusted VCS repositories CVE-2025-4674 Affected Packages: golang Issue Correction: Run dnf update golang --releasever 2023.8.20250808 or dnf update --advisory ALAS2023-2025-1104 --releasever 2023.8.20250808 to update your system. More...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2025-1101)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1101 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE:...

Amazon Linux 2023 : libnvsdm (ALAS2023NVIDIA-2025-136)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2025-136 advisory. NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an attacker could access memory outside bounds permitted under normal use cases. A...

Amazon Linux 2023 : ruby3.2, ruby3.2-bundled-gems, ruby3.2-default-gems (ALAS2023-2025-1131)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1131 advisory. The attack vector is a potential Denial of Service DoS. The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.An attacker can craft a...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1111)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1111 advisory. In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if setmemoryencrypted fails CVE-2024-36913 In the Linux kernel, the following vulnerability h...