Amazon Linux 2 : runc (ALASECS-2023-018)

The version of runc installed on the remote host is prior to 1.1.7-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-018 advisory. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signature...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASDOCKER-2023-034)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.7.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2023-034 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation c...

Important: kernel-livepatch-5.10.192-182.736

Issue Overview: A use-after-free vulnerability in the Linux kernel's net/sched: schhfsc HFSC qdisc traffic control component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve i.e. with the HFSCFSC flag set has a parent without a link-sharing curve, then...

Important: cri-tools

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: cri-tools Note: This advisory is applicable to Amazon...

Medium: kernel

Issue Overview: A flaw in the kernel Xen event handler can cause a deadlock with Xen console handling in unprivileged Xen guests. CVE-2023-34324 A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer skb was assumed to be associated with a device before callin...

Important: cni-plugins

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: cni-plugins Note: This advisory is applicable to Amazo...

Amazon Linux AMI : squid (ALAS-2023-1872)

The version of squid installed on the remote host is prior to 3.5.20-17.50. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1872 advisory. Due to a buffer overflow bug Squid is vulnerable to a Denial of Service attack against HTTP Digest Authentication CVE-2023-46847...

Amazon Linux 2023 : squid (ALAS2023-2023-402)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-402 advisory. Due to a buffer overflow bug Squid is vulnerable to a Denial of Service attack against HTTP Digest Authentication CVE-2023-46847 Tenable has extracted the preceding description block directly from the...

Amazon Linux 2 : python3 (ALAS-2023-2317)

The version of python3 installed on the remote host is prior to 3.7.10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2317 advisory. A flaw was found in Python. The built-in modules httplib and http.client included in Python 2 and Python 3, respectively ...

Amazon Linux 2 : squid (ALAS-2023-2318)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2318 advisory. An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the...

Amazon Linux AMI : ghostscript (ALAS-2023-1867)

The version of ghostscript installed on the remote host is prior to 8.70-24.33. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1867 advisory. A buffer overflow vulnerability in epscprintpage in devices/gdevepsc.c of Artifex Software GhostScript v9.50 allows a remote...

Amazon Linux AMI : tomcat8 (ALAS-2023-1861)

The version of tomcat8 installed on the remote host is prior to 8.5.93-1.94. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1861 advisory. Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the...

Amazon Linux AMI : nss-softokn (ALAS-2023-1858)

The version of nss-softokn installed on the remote host is prior to 3.53.1-6.48. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1858 advisory. new tlsfuzzer code can still detect timing issues in RSA operations CVE-2023-4421 Tenable has extracted the preceding...

Amazon Linux AMI : mutt (ALAS-2023-1865)

The version of mutt installed on the remote host is prior to 1.5.20-7.20091214hg736b6a.11. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1865 advisory. A flaw was found in mutt. When reading unencoded messages, mutt uses the line length from the untrusted input...

Amazon Linux AMI : amazon-ssm-agent (ALAS-2023-1866)

The version of amazon-ssm-agent installed on the remote host is prior to 3.2.1705.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1866 advisory. 2023-10-30: CVE-2023-24540 was added to this advisory. The x/crypto/ssh package before...

Amazon Linux AMI : apache-ivy (ALAS-2023-1863)

The version of apache-ivy installed on the remote host is prior to 2.2.0-5.2. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1863 advisory. Improper Restriction of XML External Entity Reference, XML Injection aka Blind XPath Injection vulnerability in Apache Software...

Amazon Linux AMI : exim (ALAS-2023-1860)

The version of exim installed on the remote host is prior to 4.92-1.39. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1860 advisory. Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability NOTE:...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2023-1864)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.382.b05-1.79. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1864 advisory. An issue was discovered in function ciMethodBlocks::makeblockat in Oracle JDK HotSpot VM 11, 17 and OpenJDK...

Amazon Linux AMI : libX11 (ALAS-2023-1859)

The version of libX11 installed on the remote host is prior to 1.6.0-2.2.16. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1859 advisory. libX11: out-of-bounds memory access in XkbReadKeySyms CVE-2023-43785 libX11: integer overflow in XCreateImage leading t...

Amazon Linux AMI : cups (ALAS-2023-1857)

The version of cups installed on the remote host is prior to 1.4.2-67.25. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1857 advisory. A vulnerability was found in OpenPrinting CUPS. The security flaw occurs due to failure in validating the length provided by an...