Amazon Linux 2 : ansible (ALASANSIBLE2-2023-009)

The version of ansible installed on the remote host is prior to 2.9.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ANSIBLE2-2023-009 advisory. A flaw was found in the solariszone module from the Ansible Community modules. When setting the name for the zone o...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-008)

The version of tomcat installed on the remote host is prior to 8.5.56-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2023-008 advisory. A deserialization flaw was discovered in Apache Tomcat's use of a FileStore. Under specific circumstances, an attacker can...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-002)

The version of firefox installed on the remote host is prior to 102.14.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-002 advisory. Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data fr...

Amazon Linux 2 : ruby (ALASRUBY2.6-2023-005)

The version of ruby installed on the remote host is prior to 2.6.7-126. It is, therefore, affected by a vulnerability as referenced in the ALAS2RUBY2.6-2023-005 advisory. An operating system command injection flaw was found in RDoc. Using the rdoc command to generate documentation for a malicious...

Amazon Linux 2 : libpq (ALASPOSTGRESQL12-2023-003)

The version of libpq installed on the remote host is prior to 12.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL12-2023-003 advisory. 2024-02-29: CVE-2021-23222 was added to this advisory. A man-in-the-middle attacker can inject false responses to...

Amazon Linux 2 : mod_wsgi (ALASHTTPD_MODULES-2023-001)

It is, therefore, affected by a vulnerability as referenced in the ALAS2HTTPDMODULES-2023-001 advisory. A vulnerability was found in modwsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI...

Amazon Linux 2 : microvm-kernel (ALASMICROVM-KERNEL-4.14-2023-003)

The version of microvm-kernel installed on the remote host is prior to 4.14.246-200.474. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2MICROVM-KERNEL-4.14-2023-003 advisory. A flaw was found in the Linux kernel's implementation of wireless drivers using the...

Amazon Linux 2 : ansible (ALASANSIBLE2-2023-005)

The version of ansible installed on the remote host is prior to 2.9.13-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ANSIBLE2-2023-005 advisory. A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when...

Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2023-013 (ALASFIREFOX-2023-013)

The version of firefox installed on the remote host is prior to 102.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-013 advisory. Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-008)

The version of firefox installed on the remote host is prior to 102.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-008 advisory. The Mozilla Foundation Security Advisory describes this flaw as: An attacker who compromised a content process cou...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2023-009)

The version of tomcat installed on the remote host is prior to 9.0.80-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2023-009 advisory. URL Redirection to Untrusted Site 'Open Redirect' vulnerability in FORM authentication feature Apache Tomcat.This issue affec...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL12-2023-002)

The version of postgresql installed on the remote host is prior to 12.11-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL12-2023-002 advisory. 2024-08-28: CVE-2021-3677 was added to this advisory. 2024-02-29: CVE-2021-23222 was added to this advisory....

Amazon Linux 2 : ruby (ALASRUBY3.0-2023-002)

The version of ruby installed on the remote host is prior to 3.0.4-155. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2RUBY3.0-2023-002 advisory. A double-free vulnerability was found in Ruby. The issue occurs during Regexp compilation. This flaw allows an attack...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-014)

The version of tomcat installed on the remote host is prior to 8.5.40-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2023-014 advisory. The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided da...

Amazon Linux 2 : hiredis (ALASREDIS6-2023-004)

The version of hiredis installed on the remote host is prior to 0.13.3-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2REDIS6-2023-004 advisory. Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer...

Amazon Linux 2 : python38 (ALASPYTHON3.8-2023-008)

The version of python38 installed on the remote host is prior to 3.8.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PYTHON3.8-2023-008 advisory. A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL11-2023-001)

The version of postgresql installed on the remote host is prior to 11.20-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL11-2023-001 advisory. This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap...

Amazon Linux 2 : redis (ALASREDIS6-2023-006)

The version of redis installed on the remote host is prior to 6.2.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2REDIS6-2023-006 advisory. Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can b...

Amazon Linux 2 : python38 (ALASPYTHON3.8-2023-002)

The version of python38 installed on the remote host is prior to 3.8.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PYTHON3.8-2023-002 advisory. An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing so...

Amazon Linux 2 : squid (ALASSQUID4-2023-002)

The version of squid installed on the remote host is prior to 4.15-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2SQUID4-2023-002 advisory. A flaw was found in squid. A trusted client can directly access the cache manager information, bypassing the manager ACL protecti...