Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2024-492)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-492 advisory. It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the RSA decryption result are zero. This information can be used to mount a...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2024-497)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-497 advisory. Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2024-498)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-498 advisory. 2024-02-29: CVE-2023-47108 was added to this advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as...

Amazon Linux 2023 : postfix, postfix-cdb, postfix-ldap (ALAS2023-2024-495)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-495 advisory. Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpddatarestrictions=rejectunauthpipelining and smtpddiscardehlokeywords=chunking or certain other options that exist in recent...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-488)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-488 advisory. In the Linux kernel, the following vulnerability has been resolved: iouring/afunix: disable sending iouring over sockets CVE-2023-52654 In the Linux kernel, the following vulnerability has been...

Amazon Linux 2023 : lemon, sqlite, sqlite-analyzer (ALAS2023-2024-490)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-490 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make...

Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2024-489)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-489 advisory. Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability CVE-2024-0056 NET, .NET Framework, and Visual Studio Security Feature Bypass...

Important: dotnet6.0

Issue Overview: Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability CVE-2024-0056 NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability CVE-2024-0057 Microsoft Identity Denial of service vulnerability CVE-2024-21319...

Amazon Linux 2023 : java-21-amazon-corretto, java-21-amazon-corretto-devel, java-21-amazon-corretto-headless (ALAS2023-2024-485)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-485 advisory. A vulnerability that allows an attacker to execute arbitrary java code from the javascript engine even though the option --no-java was set. CVE-2024-20918 With carefully crafted custom bytecode...

Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2024-483)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-483 advisory. A vulnerability that allows an attacker to execute arbitrary java code from the javascript engine even though the option --no-java was set. CVE-2024-20918 With carefully crafted custom bytecode...

Amazon Linux 2023 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2023-2024-482)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-482 advisory. 2024-05-03: The severity of this advisory has been changed from important to low. 2024-05-02: CVE-2024-20918 was removed from this advisory. 2024-05-02: CVE-2024-20919 was removed from this advisory...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2024-484)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-484 advisory. A vulnerability that allows an attacker to execute arbitrary java code from the javascript engine even though the option --no-java was set. CVE-2024-20918 With carefully crafted custom bytecode...

Amazon Linux 2023 : jtidy, jtidy-javadoc (ALAS2023-2024-478)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-478 advisory. An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. CVE-2023-34623 Tenable has extracted...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2024-470)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-470 advisory. An issue was discovered in the function gdevprnopenprinterseekable in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer. CVE-2023-46751 Tenable...

Amazon Linux 2023 : bluez, bluez-cups, bluez-deprecated (ALAS2023-2024-473)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-473 advisory. bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution CVE-2023-45866 Tenable has extracted the preceding description block directly from the tested produ...

Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2024-468)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-468 advisory. AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A protocol extension has been introduced by OpenSSH which needs to be applie...

Amazon Linux 2023 : p7zip, p7zip-plugins (ALAS2023-2024-481)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-481 advisory. p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCdbool at CPP/7zip/Archive/Zip/ZipIn.cpp. CVE-2022-47069 Tenable has extracted...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2024-471)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-471 advisory. Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not...

Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2024-479)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-479 advisory. Bouncy Castle for Java before 1.73 contains a potential Denial of Service DoS issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams...

Amazon Linux 2023 : squid (ALAS2023-2024-467)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-467 advisory. Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a...