Amazon Linux 2 : ansible (ALASANSIBLE2-2023-003)

The version of ansible installed on the remote host is prior to 2.9.20-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ANSIBLE2-2023-003 advisory. A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL12-2023-002)

The version of postgresql installed on the remote host is prior to 12.11-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL12-2023-002 advisory. 2024-08-28: CVE-2021-3677 was added to this advisory. 2024-02-29: CVE-2021-23222 was added to this advisory....

Amazon Linux 2 : squid (ALASSQUID4-2023-003)

The version of squid installed on the remote host is prior to 4.15-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2SQUID4-2023-003 advisory. In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occ...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-005)

The version of firefox installed on the remote host is prior to 102.11.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-005 advisory. A double-free in libwebp could have led to memory corruption and a potentially exploitable crash. CVE-2023-1999 I...

Amazon Linux 2 : mod_wsgi (ALASHTTPD_MODULES-2023-001)

It is, therefore, affected by a vulnerability as referenced in the ALAS2HTTPDMODULES-2023-001 advisory. A vulnerability was found in modwsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2023-006)

The version of tomcat installed on the remote host is prior to 9.0.54-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2023-006 advisory. A memory leak flaw was found in Apache Tomcat, where an HTTP upgrade connection does not release for WebSocket connections on...

Amazon Linux 2 : emr-puppet (ALASEMR-PUPPET-2023-001)

The version of emr-puppet installed on the remote host is prior to 6.17.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2EMR-PUPPET-2023-001 advisory. A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-008)

The version of tomcat installed on the remote host is prior to 8.5.56-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2023-008 advisory. A deserialization flaw was discovered in Apache Tomcat's use of a FileStore. Under specific circumstances, an attacker can...

Amazon Linux 2 : djvulibre (ALASMATE-DESKTOP1.X-2023-002)

The version of djvulibre installed on the remote host is prior to 3.5.27-28. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2MATE-DESKTOP1.X-2023-002 advisory. A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds write in function DJVU::filterbv via...

Amazon Linux 2 : libsepol (ALASSELINUX-NG-2023-001)

The version of libsepol installed on the remote host is prior to 2.5-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2SELINUX-NG-2023-001 advisory. The CIL compiler in SELinux 3.2 has a use-after-free in cilverifyclassperms called from cilverifyclasspermission...

Amazon Linux 2 : ruby (ALASRUBY2.6-2023-003)

The version of ruby installed on the remote host is prior to 2.6.10-130. It is, therefore, affected by a vulnerability as referenced in the ALAS2RUBY2.6-2023-003 advisory. The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-002)

The version of firefox installed on the remote host is prior to 102.14.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-002 advisory. Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data fr...

Amazon Linux 2 : squid (ALASSQUID4-2023-009)

The version of squid installed on the remote host is prior to 4.15-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2SQUID4-2023-009 advisory. An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2023-007)

The version of tomcat installed on the remote host is prior to 9.0.50-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2023-007 advisory. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-004)

The version of firefox installed on the remote host is prior to 102.9.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-004 advisory. The Mozilla Foundation describes this issue as follows: Sometimes, when invalidating JIT code while following an...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-012)

The version of tomcat installed on the remote host is prior to 8.5.51-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-012 advisory. The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a...

Amazon Linux 2 : ansible (ALASANSIBLE2-2023-001)

The version of ansible installed on the remote host is prior to 2.9.23-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ANSIBLE2-2023-001 advisory. A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through...

Amazon Linux 2 : ruby (ALASRUBY2.6-2023-004)

The version of ruby installed on the remote host is prior to 2.6.8-127. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2RUBY2.6-2023-004 advisory. An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL11-2023-002)

The version of postgresql installed on the remote host is prior to 11.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL11-2023-002 advisory. A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is...

Amazon Linux 2 : ruby (ALASRUBY2.6-2023-006)

The version of ruby installed on the remote host is prior to 2.6.7-126. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2RUBY2.6-2023-006 advisory. An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP...