Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2024-694)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-694 advisory. NOTE: https://nodejs.org/en/blog/vulnerability/april-2024-security-releases/ CVE-2024-27982 Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Prox...

Amazon Linux 2023 : python3-tqdm (ALAS2023-2024-690)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-690 advisory. tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. Th...

Amazon Linux 2023 : tpm2-tools (ALAS2023-2024-693)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-693 advisory. tpm2-tools: arbitrary quote data may go undetected by tpm2checkquote CVE-2024-29038 tpm2-tools: pcr selection value is not compared with the attest CVE-2024-29039 Tenable has extracted the...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2024-699)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-699 advisory. A defect was discovered in the Python ssl module where there is a memoryrace condition with the ssl.SSLContext methods certstorestats andgetcacerts. The race condition can be triggered if the methods...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-679)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-679 advisory. In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bondoptionarpiptargetsset CVE-2024-39487 In the Linux kernel, the following vulnerability...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2024-678)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-678 advisory. The opensslprivatedecrypt function in PHP, when using PKCS1 padding OPENSSLPKCS1PADDING, which is the default, is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that...

Amazon Linux 2023 : krb5-devel, krb5-libs, krb5-pkinit (ALAS2023-2024-688)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-688 advisory. krb5: GSS message token handling CVE-2024-37370 In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens...

Amazon Linux 2023 : mariadb105, mariadb105-backup, mariadb105-common (ALAS2023-2024-698)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-698 advisory. MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fixfieldsifneeded under...

Amazon Linux 2023 : nerdctl (ALAS2023-2024-700)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-700 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing...

Amazon Linux 2023 : rapidjson-devel (ALAS2023-2024-684)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-684 advisory. Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the GenericReader::ParseNumber function of include/rapidjson/reader.h when parsing JSON text from a stream. An...

Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2024-686)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-686 advisory. .NET Core and Visual Studio Denial of Service Vulnerability CVE-2024-30105 .NET and Visual Studio Remote Code Execution Vulnerability CVE-2024-35264 .NET and Visual Studio Denial of Service...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2024-691)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-691 advisory. NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.htmlNOTE: https://cgit.ghostscript.com/cgi- bin/cgit.cgi/ghostpdl.git/commit/?id=5ae2e320d69a7d0973011796bd388cd5befa1a43...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2024-692)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-692 advisory. Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfiapplyfilter function via a long PDF filter name. CVE-2024-29506 Artifex Ghostscript before 10.03.0 sometimes has ...

Amazon Linux 2023 : mod_http2 (ALAS2023-2024-689)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-689 advisory. Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. CVE-2024-36387 Tenable has...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-695)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-695 advisory. In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix deadlock when enabling ASPM A last minute revert in 6.7-final introduced a potential deadlock when enabling ASP...

Amazon Linux 2023 : python3-setuptools, python3-setuptools-wheel (ALAS2023-2024-676)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-676 advisory. A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-683)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-683 advisory. In the Linux kernel, the following vulnerability has been resolved: Input: cyapa - add missing input core locking to suspend/resume functions CVE-2023-52884 In the Linux kernel, the following...

Amazon Linux 2023 : gtk3, gtk3-devel, gtk3-immodule-xim (ALAS2023-2024-675)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-675 advisory. gtk3: gtk2: Library injection from CWD CVE-2024-6655 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for this...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-696)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-696 advisory. In the Linux kernel, the following vulnerability has been resolved: iouring: drop any code related to SCMRIGHTS CVE-2023-52656 In the Linux kernel, the following vulnerability has been resolved...

Amazon Linux 2023 : squid (ALAS2023-2024-687)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-687 advisory. Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This erro...