Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2023-307)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-307 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fi...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-314)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-314 advisory. 2024-05-09: CVE-2022-3597 was added to this advisory. LibTIFF 4.4.0 has an out-of-bounds write in TIFFmemcpy in libtiff/tifunix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826...

Amazon Linux 2023 : librsvg2, librsvg2-devel, librsvg2-tools (ALAS2023-2023-295)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-295 advisory. A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files on the local filesystem outside of the expected area, as demonstrat...

Amazon Linux 2023 : jsoup, jsoup-javadoc (ALAS2023-2023-315)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-315 advisory. jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting XSS safety. jsoup may incorrectly sanitize HTML including javascript: URL expressions, which could allow...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2023-308)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-308 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fi...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2023-312)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-312 advisory. On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2023-300)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-300 advisory. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-304)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-304 advisory. The use of Module.load can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. Please note that at the time this CVE was issued, the policy...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-290)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-290 advisory. Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2023-291)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-291 advisory. A heap-based buffer overflow flaw was found in Redis. This flaw allows an attacker to trick an authenticated user into executing a specially crafted Lua script in Redis. This attack triggers a heap...

Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2023-280)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-280 advisory. A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence o...

Amazon Linux 2023 : avahi, avahi-autoipd, avahi-compat-howl (ALAS2023-2023-272)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-272 advisory. A reachable assertion was found in avahidnspacketappendrecord. CVE-2023-38469 A reachable assertion was found in avahiescapelabel. CVE-2023-38470 A reachable assertion was found in...

Amazon Linux 2023 : poppler, poppler-cpp, poppler-cpp-devel (ALAS2023-2023-289)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-289 advisory. Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder JBIG2Stream::readTextRegionSeg in JBIGStream.cc. Processing a specially crafted PDF file or JBIG2 image could lea...

Amazon Linux 2023 : libnghttp2, libnghttp2-devel, nghttp2 (ALAS2023-2023-278)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-278 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY fram...

Amazon Linux 2023 : grpc, grpc-cpp, grpc-data (ALAS2023-2023-282)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-282 advisory. 2023-10-12: CVE-2023-4785 was added to this advisory. When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-285)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-285 advisory. 2023-08-31: CVE-2023-3611 was removed from this advisory. 2023-08-31: CVE-2023-3776 was removed from this advisory. 2023-08-31: The severity of this advisory was changed from important to mediu...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-287)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-287 advisory. A Gather Data Sampling GDS transient execution side-channel vulnerability was found affecting certain Intel processors. This issue may allow a local attacker using gather instruction load from memory to...

Amazon Linux 2023 : python3-mako (ALAS2023-2023-288)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-288 advisory. Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin. CVE-2022-40023 Tenable has extract...

Amazon Linux 2023 : yajl, yajl-devel (ALAS2023-2023-263)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-263 advisory. yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when...

Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-242)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-242 advisory. .NET Denial of Service Vulnerability. CVE-2023-21538 .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability CVE-2023-24895 .NET, .NET Framework, and Visual Studio Elevation...