Amazon Linux 2 : amazon-ssm-agent (ALAS-2022-1807)

The version of amazon-ssm-agent installed on the remote host is prior to 3.1.1575.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1807 advisory. A buffer overflow flaw was found in Golang's library encoding/pem. This flaw allows an attacker to use a large PEM...

Amazon Linux 2 : rust (ALAS-2022-1817)

The version of rust installed on the remote host is prior to 1.61.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1817 advisory. A race condition flaw was found in Rust's std::fs::removedirall function. Rust applications that use this function may be vulnerable ...

Amazon Linux 2 : log4j-cve-2021-44228-hotpatch (ALAS-2022-1806)

The version of log4j-cve-2021-44228-hotpatch installed on the remote host is prior to 1.3-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1806 advisory. Versions of the Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3-5 are affected by a race...

Important: log4j-cve-2021-44228-hotpatch

Issue Overview: Versions of the Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3-5 are affected by a race condition that could lead to a local privilege escalation. The Apache Log4j Hotpatch is not a replacement for updating to a log4j version that mitigates CVE-2021-44228 o...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2022-026 (ALASKERNEL-5.4-2022-026)

The version of kernel installed on the remote host is prior to 5.4.196-108.356. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-026 advisory. In the Linux kernel, the following vulnerability has been resolved: dm: fix mempool NULL pointer race when...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2022-020)

The version of containerd installed on the remote host is prior to 1.4.13-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2022-020 advisory. A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daem...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2022-001)

The version of kernel installed on the remote host is prior to 5.15.43-20.123. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2022-001 advisory. A flaw was found in unrestricted eBPF usage by the BPFBTFLOAD, leading to a possible out-of-bounds memory...

Amazon Linux 2 : containerd (ALASDOCKER-2022-019)

The version of containerd installed on the remote host is prior to 1.4.13-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2022-019 advisory. A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to...

Amazon Linux 2 : containerd, docker (ALASNITRO-ENCLAVES-2022-019)

The version of containerd installed on the remote host is prior to 1.4.13-2. The version of docker installed on the remote host is prior to 20.10.13-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO- ENCLAVES-2022-019 advisory. A flaw was found in Moby Docker Engine...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-014)

The version of kernel installed on the remote host is prior to 5.10.118-111.515. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-014 advisory. In the Linux kernel, the following vulnerability has been resolved: dm: fix mempool NULL pointer race wh...

Amazon Linux 2 : kernel, --advisory ALAS2-2022-1798 (ALAS-2022-1798)

The version of kernel installed on the remote host is prior to 4.14.281-212.502. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1798 advisory. In the Linux kernel, the following vulnerability has been resolved: dm: fix mempool NULL pointer race when...

Amazon Linux 2 : microcode_ctl (ALAS-2022-1800)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1800 advisory. A flaw was found in hw. Processor optimization removal or modification of security-critical code for some IntelR processors may...

Amazon Linux 2 : openssl (ALAS-2022-1801)

The version of openssl installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1801 advisory. The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by so...

Amazon Linux 2 : python (ALAS-2022-1802)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1802 advisory. In Python3's Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via HTTP. CVE-2020-27619 The...

Amazon Linux 2 : thunderbird (ALAS-2022-1804)

The version of thunderbird installed on the remote host is prior to 91.9.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1804 advisory. The Mozilla Foundation Security Advisory describes this flaw as:An attacker could have sent a message to the parent...

Amazon Linux 2 : vim, --advisory ALAS2-2022-1805 (ALAS-2022-1805)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1805 advisory. A flaw was found in vim. The vulnerability occurs due to a crash when recording and using Select mode and leads to an out-of-bounds read. This flaw allows an attacker to input a specially crafted...

Amazon Linux 2 : libtiff (ALAS-2022-1799)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1799 advisory. A flaw was found in libtiff where a NULL source pointer passed as an argument to the memcpy function within the TIFFReadDirectory ...

Amazon Linux 2 : xmlrpc-c (ALAS-2022-1795)

The version of xmlrpc-c installed on the remote host is prior to 1.32.5-1905.svn2451. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1795 advisory. A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XM...

Amazon Linux 2 : openldap (ALAS-2022-1796)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1796 advisory. In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an...

Critical: xmlrpc-c

Issue Overview: A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This issue is dependent on how invalid UTF-8 is handled inside the XML processor...