Important: perl-Pod-Perldoc

Issue Overview: HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. CVE-2023-31486 Affected Packages: perl-Pod-Perldoc Issue Correction: Run dnf update perl-Pod-Perldoc...

Important: perl-HTTP-Tiny

Issue Overview: HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. CVE-2023-31486 Affected Packages: perl-HTTP-Tiny Note: This advisory is applicable to Amazon Linux 2 AL2 Co...

Medium: binutils

Issue Overview: Potential heap based buffer overflow found in bfdelfslurpversiontables in bfd/elf.c. CVE-2023-1972 Affected Packages: binutils Issue Correction: Run dnf update binutils --releasever 2023.1.20230628 or dnf update --advisory ALAS2023-2023-229 --releasever 2023.1.20230628 to update...

Important: mod_security

Issue Overview: In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity C language codebase. CVE-2022-48279...

Amazon Linux AMI : mysql57 (ALAS-2023-1768)

The version of mysql57 installed on the remote host is prior to 5.7.42-1.19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1768 advisory. 2024-05-23: CVE-2023-22007 was added to this advisory. Vulnerability in the MySQL Server product of Oracle MySQL...

Amazon Linux AMI : glib2 (ALAS-2023-1769)

The version of glib2 installed on the remote host is prior to 2.36.3-5.25. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1769 advisory. PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote...

Amazon Linux 2 : ruby (ALAS-2023-2084)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2084 advisory. A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2023-209)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-209 advisory. html/template: improper sanitization of CSS values Angle brackets were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a...

Amazon Linux 2 : vim (ALAS-2023-2085)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2085 advisory. NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. CVE-2023-2609 Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. CVE-2023-2610 Tenable has...

Amazon Linux 2 : xmlrpc (ALAS-2023-2089)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2089 advisory. XML external entity XXE vulnerability in the Apache XML-RPC aka ws-xmlrpc library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery SSRF attacks via a crafte...

Amazon Linux 2023 : opensc (ALAS2023-2023-207)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-207 advisory. A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardoshaveverifyrcpackage. The attacker can supply a smart card package with malformed ASN1 context...

Amazon Linux 2 : jettison (ALAS-2023-2086)

The version of jettison installed on the remote host is prior to 1.3.3-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2086 advisory. 2024-02-01: CVE-2022-40150 was added to this advisory. Those using Jettison to parse untrusted XML or JSON data may be...

Amazon Linux 2023 : bluez, bluez-cups, bluez-deprecated (ALAS2023-2023-212)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-212 advisory. A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-210)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-210 advisory. An untrusted search path vulnerability exists in Node.js. 19.6.1, 18.14.1, 16.19.1, and 14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges...

Amazon Linux 2023 : runc (ALAS2023-2023-208)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-208 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes /sys/fs/cgroup writable in following...

Amazon Linux 2 : webkitgtk4 (ALAS-2023-2088)

The version of webkitgtk4 installed on the remote host is prior to 2.38.5-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2088 advisory. 2024-08-28: CVE-2022-22620 was added to this advisory. 2024-08-14: CVE-2022-32893 was added to this advisory. A logic...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-211)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-211 advisory. In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. CVE-2022-48425 Tenable has extracted the preceding description bloc...

Amazon Linux 2 : python-pillow (ALAS-2023-2087)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2087 advisory. An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invali...

Medium: xmlrpc

Issue Overview: XML external entity XXE vulnerability in the Apache XML-RPC aka ws-xmlrpc library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery SSRF attacks via a crafted DTD. CVE-2016-5002 Affected Packages: xmlrpc Note: This advisory is...

Important: vim

Issue Overview: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. CVE-2023-2609 Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. CVE-2023-2610 Affected Packages: vim Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit...