Amazon Linux 2022 : rubygem-nokogiri (ALAS2022-2022-062)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-062 advisory. Nokogiri is an open source XML and HTML library for Ruby. Nokogiri = 1.13.4. There are no known workarounds for this issue. CVE-2022-24836 Tenable has extracted the preceding description block directly...

Amazon Linux 2022 : zziplib, zziplib-devel, zziplib-utils (ALAS2022-2022-081)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-081 advisory. Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value zzipfileread in the function unzzipcatfile. CVE-2020-18442 Tenable has extracted the preceding...

Amazon Linux 2022 : vim-common, vim-data, vim-default-editor (ALAS2022-2022-116)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-116 advisory. A heap buffer over-read vulnerability was found in Vim's grabfilename function of the src/findfile.c file. This flaw occurs because the function reads after the NULL terminates the line with gf...

Amazon Linux 2022 : tomcat, tomcat-admin-webapps, tomcat-el-3.0-api (ALAS2022-2022-044)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-044 advisory. The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a...

Amazon Linux 2022 : gzip, xz, xz-devel (ALAS2022-2022-058)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-058 advisory. An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's...

Amazon Linux 2022 : python3-twisted, python3-twisted+tls (ALAS2022-2022-046)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-046 advisory. An uncontrolled resource consumption flaw was found in python-twisted in the dataReceived function. This flaw allows an unauthenticated, remote attacker to send a simple command to use all available...

Amazon Linux 2022 : postgresql14, postgresql14-contrib, postgresql14-llvmjit (ALAS2022-2022-124)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-124 advisory. A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH...

Amazon Linux 2022 : polkit, polkit-devel, polkit-libs (ALAS2022-2022-102)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-102 advisory. There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion.The highest threat from this vulnerability is to availability. NOTE:...

Amazon Linux 2022 : rsyslog, rsyslog-crypto, rsyslog-elasticsearch (ALAS2022-2022-075)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-075 advisory. A flaw was found in the way rsyslog handled invalid log message priority values. In certain configurations, a local attacker, or a remote attacker able to connect to the rsyslog port, could use...

Amazon Linux 2022 : java-11-openjdk, java-11-openjdk-demo, java-11-openjdk-devel (ALAS2022-2022-047)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-047 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported versions that are affected are Oracle Java SE: 7u321, 8u311,...

Amazon Linux 2022 : libblkid, libblkid-devel, libfdisk (ALAS2022-2022-086)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-086 advisory. A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to...

Amazon Linux 2022 : minizip-compat, minizip-compat-devel, zlib (ALAS2022-2022-100)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-100 advisory. An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large number of...

Amazon Linux 2022 : openssl, openssl-devel, openssl-libs (ALAS2022-2022-123)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-123 advisory. A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passed the file names of certificates being hashed to a command executed through...

Amazon Linux 2022 : logrotate (ALAS2022-2022-095)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-095 advisory. A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock...

Amazon Linux 2022 : containerd, containerd-stress (ALAS2022-2022-088)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-088 advisory. A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the ExecSync API. This can cause...

Amazon Linux 2022 : containerd, containerd-stress, docker (ALAS2022-2022-054)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-054 advisory. A flaw was found in Moby Docker Engine, where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with...

Amazon Linux 2022 : cpp, gcc, gcc-c++ (ALAS2022-2022-057)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-057 advisory. A flaw was found in the way Unicode standards are implemented in the context of development environments, which have specialized requirements for rendering text. An attacker could exploit this to deceiv...

Amazon Linux 2022 : openssl1.1 (ALAS2022-2022-105)

The version of openssl1.1 installed on the remote host is prior to 1.1.1l-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-105 advisory. The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed b...

Amazon Linux 2022 : openjpeg2, openjpeg2-devel, openjpeg2-tools (ALAS2022-2022-122)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-122 advisory. A flaw was found in the opj2decompress program in openjpeg2 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of t...

Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-125)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-125 advisory. A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. CVE-2022-2990...