Important: kernel-livepatch-4.14.192-147.314

Issue Overview: An issue has been reported in the Linux kernel's handling of raw sockets. This issue can be used locally to cause denial of service or local privilege escalation from unprivileged processes or from containers with the CAPNETRAW capability enabled. See Also:...

Important: kernel-livepatch-4.14.186-146.268

Issue Overview: An issue has been reported in the Linux kernel's handling of raw sockets. This issue can be used locally to cause denial of service or local privilege escalation from unprivileged processes or from containers with the CAPNETRAW capability enabled. See Also:...

Amazon Linux 2 : kernel (ALAS-2020-1488)

The version of kernel installed on the remote host is prior to 4.14.193-149.317. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1488 advisory. An issue has been reported in the Linux kernel's handling of raw sockets. This issue can be used locally to cause denial of...

Amazon Linux AMI : kernel (ALAS-2020-1430)

The version of kernel installed on the remote host is prior to 4.14.193-113.317. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1430 advisory. 2024-05-23: CVE-2020-14356 was added to this advisory. A flaw null pointer dereference in the Linux kernel cgroupv2...

Amazon Linux AMI : python34, python36, python35 (ALAS-2020-1432)

The version of python34 installed on the remote host is prior to 3.4.10-1.52. The version of python35 installed on the remote host is prior to 3.5.9-1.28. The version of python36 installed on the remote host is prior to 3.6.12-1.19. It is, therefore, affected by multiple vulnerabilities as...

Amazon Linux AMI : chrony (ALAS-2020-1431)

The version of chrony installed on the remote host is prior to 3.2-1.27. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1431 advisory. A flaw was found in chrony when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup...

Important: kernel

Issue Overview: An issue has been reported in the Linux kernel's handling of raw sockets. This issue can be used locally to cause denial of service or local privilege escalation from unprivileged processes or from containers with the CAPNETRAW capability enabled. See Also:...

Amazon Linux 2 : squid (ALAS-2020-1486)

The version of squid installed on the remote host is prior to 3.5.20-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1486 advisory. An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive informatio...

Amazon Linux 2 : thunderbird (ALAS-2020-1487)

The version of thunderbird installed on the remote host is prior to 68.11.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1487 advisory. Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit hea...

Amazon Linux 2 : qemu (ALAS-2020-1485)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1485 advisory. A use after free vulnerability in ipreass in ipinput.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial o...

Amazon Linux 2 : postgresql-jdbc (ALAS-2020-1482)

The version of postgresql-jdbc installed on the remote host is prior to 9.2.1002-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1482 advisory. PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE. A flaw was found in PostgreSQL JDBC in versions prior to...

Amazon Linux 2 : python (ALAS-2020-1483)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1483 advisory. In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by...

Important: postgresql-jdbc

Issue Overview: PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE. A flaw was found in PostgreSQL JDBC in versions prior to 42.2.13. An XML External Entity XXE weakness was found in PostgreSQL JDBC. The highest threat from this vulnerability is to data confidentiality and system...

Medium: python

Issue Overview: In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation. CVE-2019-20907 Affected Packages: python Note: This advisory is applicable to Amazon Linux 2 AL2...

Amazon Linux 2 : python3 (ALAS-2020-1484)

The version of python3 installed on the remote host is prior to 3.7.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1484 advisory. Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes,...

Amazon Linux AMI : samba (ALAS-2020-1424)

The version of samba installed on the remote host is prior to 4.10.4-11.51. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1424 advisory. A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when...

Amazon Linux AMI : python34, python35 (ALAS-2020-1429)

The version of python34 installed on the remote host is prior to 3.4.10-1.51. The version of python35 installed on the remote host is prior to 3.5.9-1.27. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1429 advisory. In Lib/tarfile.py in Python through 3.8.3...

Amazon Linux AMI : python-rsa (ALAS-2020-1421)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1421 advisory. Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses...

Amazon Linux AMI : httpd24 (ALAS-2020-1418)

The version of httpd24 installed on the remote host is prior to 2.4.46-1.90. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1418 advisory. 2024-10-09: CVE-2020-11984 was removed from this advisory. 2024-10-09: CVE-2020-9490 was removed from this advisory. 2024-10-09:...

Amazon Linux AMI : lynis (ALAS-2020-1419)

The version of lynis installed on the remote host is prior to 3.0.0-1.17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1419 advisory. In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is...