Important: ipa

Issue Overview: A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function berscanf was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2020-1421)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.252.b09-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1421 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...

Amazon Linux 2 : http-parser (ALAS-2020-1417)

The version of http-parser installed on the remote host is prior to 2.7.1-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1417 advisory. HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed...

Amazon Linux 2 : telnet (ALAS-2020-1422)

The version of telnet installed on the remote host is prior to 0.17-65. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1422 advisory. utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data...

Amazon Linux 2 : ipmitool (ALAS-2020-1420)

The version of ipmitool installed on the remote host is prior to 1.8.18-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1420 advisory. It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN...

Amazon Linux 2 : icu (ALAS-2020-1418)

The version of icu installed on the remote host is prior to 50.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1418 advisory. An issue was discovered in International Components for Unicode ICU for C/C++ through 66.1. An integer overflow, leading to a heap-based...

Amazon Linux 2 : git (ALAS-2020-1416)

The version of git installed on the remote host is prior to 2.23.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1416 advisory. Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an...

Important: http-parser

Issue Overview: HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed CVE-2019-15605 Affected Packages: http-parser Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference...

Important: ipmitool

Issue Overview: It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run...

Important: icu

Issue Overview: An issue was discovered in International Components for Unicode ICU for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend function in common/unistr.cpp. CVE-2020-10531 Affected Packages: icu Note: This advisory ...

Amazon Linux 2 : libvncserver (ALAS-2020-1411)

The version of libvncserver installed on the remote host is prior to 0.9.9-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1411 advisory. Integer Overflow or Wraparound leads to Heap-based Buffer Overflow CVE-2019-15690 Tenable has extracted the preceding...

Amazon Linux 2 : python-virtualenv (ALAS-2020-1413)

The version of python-virtualenv installed on the remote host is prior to 15.1.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1413 advisory. urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirec...

Amazon Linux 2 : xerces-c (ALAS-2020-1415)

The version of xerces-c installed on the remote host is prior to 3.1.1-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1415 advisory. A use-after-free vulnerability was found in xerces-c in the way an XML document is processed via the SAX API. Applications that...

Amazon Linux 2 : thunderbird (ALAS-2020-1414)

The version of thunderbird installed on the remote host is prior to 68.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1414 advisory. The Mozilla Foundation Security Advisory describes this flaw as: When removing data about an origin whose tab was...

Amazon Linux 2 : python-pillow (ALAS-2020-1412)

The version of python-pillow installed on the remote host is prior to 2.0.0-20.gitd1c6db8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1412 advisory. A flaw was discovered in the way the python-pillow may allocate a large amount of memory or require a lo...

Important: python-pillow

Issue Overview: A flaw was discovered in the way the python-pillow may allocate a large amount of memory or require a long time while processing specially crafted image files, possibly causing a denial of service. Applications that use the library to process untrusted files may be vulnerable to...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2020-1410)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.7+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1410 advisory. Further information about this update can be found in the Corretto 11 change log...

Amazon Linux 2 : git (ALAS-2020-1409)

The version of git installed on the remote host is prior to 2.23.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1409 advisory. With a crafted URL that contains a newline in it, the credential helper machinery can be fooled to give credential information for a...

Important: git

Issue Overview: With a crafted URL that contains a newline in it, the credential helper machinery can be fooled to give credential information for a wrong host. The attack has been made impossible by forbidding a newline character in any value passed via the credential protocol. CVE-2020-5260...

Important: java-11-amazon-corretto

Issue Overview: Further information about this update can be found in the Corretto 11 change log https://github.com/corretto/corretto-11/blob/develop/CHANGELOG.md Affected Packages: java-11-amazon-corretto Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ...