Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-193)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-193 advisory. The curl advisory describes this issue as follows: curl supports communicating using the TELNET protocol and as a part of this it offers users to pass on user name and telnet options for the...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-189)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-189 advisory. 2024-05-09: CVE-2022-33196 was added to this advisory. Insufficient granularity of access control in out-of-band management in some IntelR Atom and Intel Xeon Scalable Processors may allow a...

Important: perl-CPAN

Issue Overview: HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. CVE-2023-31484 Affected Packages: perl-CPAN Issue Correction: Run dnf update perl-CPAN --releasever...

Medium: cloud-init

Issue Overview: Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege. CVE-2023-1786 Affected Packages: cloud-init Issue Correction: Run dnf update cloud-init --releasever...

Medium: dnsmasq

Issue Overview: An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. CVE-2023-28450 Affected Packages: dnsmasq Issue Correction: Run dnf update dnsmasq --releasever 2023.0.20230607 or dnf update...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-179)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-179 advisory. qfqchangeclass in net/sched/schqfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQMINLMAX. CVE-2023-31436 Tenable has extracted the preceding description...

Amazon Linux 2023 : perl, perl-Attribute-Handlers, perl-AutoLoader (ALAS2023-2023-178)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-178 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. CVE-2023-31484 Tenable has...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-181)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-181 advisory. A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able ...

Amazon Linux 2023 : git, git-all, git-core (ALAS2023-2023-180)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-180 advisory. Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to git apply...

Important: kernel-livepatch-6.1.12-19.43

Issue Overview: In the Linux kernel before 6.1.13, there is a double free in net/mpls/afmpls.c upon an allocation failure for registering the sysctl table under a new location during the renaming of a device. CVE-2023-26545 Affected Packages: kernel-livepatch-6.1.12-19.43 Issue Correction: Please...

Amazon Linux 2023 : openldap, openldap-clients, openldap-compat (ALAS2023-2023-177)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-177 advisory. In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion ... NOTE: https://bugs.openldap.org/showbug.cgi?id=9454NOTE: trunk:...

Amazon Linux 2023 : python3-future (ALAS2023-2023-173)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-173 advisory. An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server. CVE-2022-40899 Tenable has...

Amazon Linux 2023 : apache-ivy, apache-ivy-javadoc (ALAS2023-2023-174)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-174 advisory. A flaw was found in Apache Ivy. With Apache Ivy 2.4.0, an optional packaging attribute was introduced that allows artifacts to be unpacked on the fly if pack200 or zip packaging was used. This...

Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2023-166)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-166 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf,...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2023-165)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-165 advisory. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token JWT...

Amazon Linux 2023 : gnutls, gnutls-c++, gnutls-dane (ALAS2023-2023-171)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-171 advisory. A timing side-channel vulnerability was found in RSA ClientKeyExchange messages in GnuTLS. This side- channel may be sufficient to recover the key encrypted in the RSA ciphertext across a network in a...

Amazon Linux 2023 : nasm, nasm-rdoff (ALAS2023-2023-172)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-172 advisory. NASM v2.16 was discovered to contain a heap buffer overflow in the component quoteforpmake asm/nasm.c:856 CVE-2022-44370 Tenable has extracted the preceding description block directly from the tested...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2023-162)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-162 advisory. In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode,...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2023-164)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-164 advisory. Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and...

Amazon Linux 2023 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2023-2023-170)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-170 advisory. Possible heap-based buffer overflow attack in ImportMultiSpectralQuantum in MagickCore/quantum-import.c for ImageMagick CVE-2023-1906 Tenable has extracted the preceding description block directly from...