Amazon Linux AMI : varnish (ALAS-2022-1632)

The version of varnish installed on the remote host is prior to 4.0.5-3.23. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1632 advisory. A flaw was found in Varnish. This flaw allows an attacker to carry out a request smuggling attack on HTTP/1 connections on Varnis...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2022-006)

The version of kernel installed on the remote host is prior to 5.15.57-29.131. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2022-006 advisory. A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-034)

The version of kernel installed on the remote host is prior to 5.4.209-116.363. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-034 advisory. An out-of-bounds write flaw was found in the Linux kernel's framebuffer-based console driver functionality...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-019)

The version of kernel installed on the remote host is prior to 5.10.135-122.509. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-019 advisory. - Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type...

Amazon Linux AMI : 389-ds-base (ALAS-2022-1629)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-16.69. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1629 advisory. A double free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker cou...

Medium: gnupg2

Issue Overview: A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in g10/cpr.c. This flaw allows a malicious actor to bypass access control. CVE-2022-34903 Affected Packages: gnupg2 Note: This advisory is applicable to...

Amazon Linux 2 : kernel (ALAS-2022-1833)

The version of kernel installed on the remote host is prior to 4.14.290-217.505. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1833 advisory. An out-of-bounds write flaw was found in the Linux kernel's framebuffer-based console driver functionality in the...

Amazon Linux 2 : gnupg2 (ALAS-2022-1834)

The version of gnupg2 installed on the remote host is prior to 2.0.22-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1834 advisory. A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in...

The vulnerability of the TIFFFetchStripThing() function in the LibTIFF library on Amazon Linux systems allows a hacker to trigger a service failure.

The vulnerability of the TIFFFetchStripThing function in the LibTIFF library is related to the use of uninitialized resources during the processing of TIFF files. Exploiting this vulnerability could allow an attacker to cause service failures...

Amazon Linux 2 : openssl11 (ALAS-2022-1832)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1832 advisory. A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passe...

Amazon Linux 2 : golang, --advisory ALAS2-2022-1830 (ALAS-2022-1830)

The version of golang installed on the remote host is prior to 1.18.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1830 advisory. A null pointer dereference vulnerability was found in golang. When using the library's ssh server without specifying an...

Medium: openssl

Issue Overview: A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passed the file names of certificates being hashed to a command executed through the shell. Some operating systems distribute this script in a manner where it ...

Medium: openssl11

Issue Overview: A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passed the file names of certificates being hashed to a command executed through the shell. Some operating systems distribute this script in a manner where it ...

Amazon Linux AMI : vim (ALAS-2022-1628)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1628 advisory. Use after free in appendcommand in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote...

Amazon Linux AMI : exim (ALAS-2022-1622)

The version of exim installed on the remote host is prior to 4.92-1.33. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1622 advisory. Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory owned ...

Amazon Linux AMI : tomcat8 (ALAS-2022-1627)

The version of tomcat8 installed on the remote host is prior to 8.5.81-1.91. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1627 advisory. A flaw was found in the tomcat package. When a web application sends a WebSocket message concurrently with the WebSocke...

Amazon Linux AMI : openssl (ALAS-2022-1626)

The version of openssl installed on the remote host is prior to 1.0.2k-16.159. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1626 advisory. A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly pass...

Amazon Linux AMI : 389-admin (ALAS-2022-1619)

The version of 389-admin installed on the remote host is prior to 1.1.46-5.14. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1619 advisory. A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then inste...

Amazon Linux AMI : kernel (ALAS-2022-1624)

The version of kernel installed on the remote host is prior to 4.14.287-148.504. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1624 advisory. There are use-after-free vulnerabilities caused by timer handler in net/rose/rosetimer.c of linux that allow...

Amazon Linux AMI : clamav (ALAS-2022-1621)

The version of clamav installed on the remote host is prior to 0.103.6-1.49. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1621 advisory. On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2...