Medium: rsync

Issue Overview: A security vulnerability was found in zlib. The flaw triggered a heap-based buffer in inflate in the inflate.c function via a large gzip header extra field. This flaw is only applicable in the call inflateGetHeader. CVE-2022-37434 Affected Packages: rsync Note: This advisory is...

Important: glusterfs

Issue Overview: In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read. CVE-2023-26253 Affected Packages: glusterfs Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between A...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-019 (ALASKERNEL-5.15-2023-019)

The version of kernel installed on the remote host is prior to 5.15.104-63.140. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-019 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: block range must be validated...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2023-020)

The version of kernel installed on the remote host is prior to 5.15.110-70.143. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-020 advisory. A denial of service problem was found, due to a possible recursive locking scenario, resulting in a...

Amazon Linux AMI : tar (ALAS-2023-1755)

The version of tar installed on the remote host is prior to 1.26-31.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1755 advisory. paxdecodeheader in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed...

Amazon Linux AMI : squid (ALAS-2023-1757)

The version of squid installed on the remote host is prior to 3.5.20-17.46. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1757 advisory. An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTT...

Amazon Linux 2 : runc (ALASDOCKER-2023-025)

The version of runc installed on the remote host is prior to 1.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2023-025 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was...

Amazon Linux AMI : squid (ALAS-2023-1754)

The version of squid installed on the remote host is prior to 3.5.20-17.45. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1754 advisory. An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the...

Amazon Linux AMI : perl (ALAS-2023-1751)

The version of perl installed on the remote host is prior to 5.16.3-294.44. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1751 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration whe...

Amazon Linux AMI : kernel (ALAS-2023-1750)

The version of kernel installed on the remote host is prior to 4.14.314-164.539. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1750 advisory. In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch requests can be abused to...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-033)

The version of kernel installed on the remote host is prior to 5.10.179-168.710. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-033 advisory. A denial of service problem was found, due to a possible recursive locking scenario, resulting in a...

Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2023-004)

The version of java-11-openjdk installed on the remote host is prior to 11.0.19.0.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2JAVA-OPENJDK11-2023-004 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java S...

Amazon Linux AMI : libksba (ALAS-2023-1752)

The version of libksba installed on the remote host is prior to 1.3.5-1.11. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1752 advisory. Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. CVE-2022-47629 Tenable has...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-046)

The version of kernel installed on the remote host is prior to 5.4.242-156.349. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2023-046 advisory. In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch requests can be...

Amazon Linux AMI : libssh2 (ALAS-2023-1756)

The version of libssh2 installed on the remote host is prior to 1.4.2-3.13. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1756 advisory. An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the libssh2packetrequire and libssh2packetrequirev...

Amazon Linux AMI : exim (ALAS-2023-1753)

The version of exim installed on the remote host is prior to 4.92-1.37. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1753 advisory. Exim before 4.96 has an invalid free in pamconverse in auths/callpam.c because storefree is not used after storemalloc. CVE-2022-3745...

Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2023-024)

The version of runc installed on the remote host is prior to 1.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2023-024 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions ...

Amazon Linux 2 : microcode_ctl (ALAS-2023-2056)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2056 advisory. 2024-05-09: CVE-2022-33196 was added to this advisory. Insufficient granularity of access control in out-of-band...

Amazon Linux 2 : qemu (ALAS-2023-2060)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2060 advisory. An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits tx descriptors in...

Amazon Linux 2 : kernel (ALAS-2023-2050)

The version of kernel installed on the remote host is prior to 4.14.314-238.539. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2050 advisory. In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch requests can be abused to...