Amazon Linux 2 : postgresql (ALASPOSTGRESQL12-2024-011)

The version of postgresql installed on the remote host is prior to 12.20-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL12-2024-011 advisory. Time-of-check Time-of-use TOCTOU race condition in pgdump in PostgreSQL allows an object creator to execute arbitrary...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASDOCKER-2024-046)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.9.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2024-046 advisory. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2024-055 (ALASKERNEL-5.15-2024-055)

The version of kernel installed on the remote host is prior to 5.15.167-112.165. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-055 advisory. In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Fix...

Medium: c-ares

Issue Overview: Insufficient randomness in generation of DNS query IDs When /dev/urandom or RtlGenRandom are unavailable, c-ares uses rand to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand so will generate predictable output. Input from th...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2024-070 (ALASKERNEL-5.10-2024-070)

The version of kernel installed on the remote host is prior to 5.10.226-214.879. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-070 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free after...

Amazon Linux 2 : python38-setuptools (ALASPYTHON3.8-2024-012)

The version of python38-setuptools installed on the remote host is prior to 38.4.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2PYTHON3.8-2024-012 advisory. A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name CVE-2024-39494 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between...

Important: golang

Issue Overview: Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion. CVE-2024-34155 Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a...

Amazon Linux 2 : php (ALASPHP8.2-2024-005)

The version of php installed on the remote host is prior to 8.2.23-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.2-2024-005 advisory. In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, due to a code logic error, filtering functions such as...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2024-086 (ALASKERNEL-5.4-2024-086)

The version of kernel installed on the remote host is prior to 5.4.284-196.380. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-086 advisory. In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's...

Amazon Linux 2 : firefox (ALASFIREFOX-2024-029)

The version of firefox installed on the remote host is prior to 115.15.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-029 advisory. 2024-09-26: CVE-2024-7652 was added to this advisory. An error in the ECMA-262 specification relating to Async...

Amazon Linux 2 : microcode_ctl (ALAS-2024-2635)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2635 advisory. 2024-10-10: CVE-2024-22374 was added to this advisory. Improper isolation in some IntelR Processors stream cache...

Amazon Linux 2 : systemd (ALAS-2024-2636)

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2636 advisory. An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: xen/events: close evtchn after mapping cleanup CVE-2024-26687 In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize CVE-2024-35807 Affected Packages: kernel...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize CVE-2024-35807 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.15 Extra. Visit this page to learn more about Amazon Linux 2 AL2...

Important: kernel-livepatch-5.10.220-209.869

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix double free on error CVE-2024-41087 Affected Packages: kernel-livepatch-5.10.220-209.869 Issue Correction: Please ensure you have live patching enabled. Run yum update...

Amazon Linux 2 : ruby (ALAS-2024-2637)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2637 advisory. A flaw was found in the way the Ruby REXML library parsed XML documents. Parsing a specially crafted XML document using...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-052)

The version of kernel installed on the remote host is prior to 5.15.166-111.163. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-052 advisory. 2024-09-26: CVE-2024-46763 was added to this advisory. 2024-09-26: CVE-2024-46707 was added to this...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-054)

The version of kernel installed on the remote host is prior to 5.15.149-99.162. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.15-2024-054 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize...

Amazon Linux 2 : kernel (ALAS-2024-2633)

The version of kernel installed on the remote host is prior to 4.14.336-257.566. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2633 advisory. 2024-12-05: CVE-2024-26687 was added to this advisory. In the Linux kernel, the following vulnerability has been...