Amazon Linux 2 : python-lxml (ALAS-2021-1666)

The version of python-lxml installed on the remote host is prior to 3.2.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1666 advisory. A Cross-site Scripting XSS vulnerability was found in the python-lxml's clean module. The module's parser did not properly...

Amazon Linux 2 : slapi-nis (ALAS-2021-1646)

The version of slapi-nis installed on the remote host is prior to 0.56.5-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1646 advisory. A flaw was found in slapi-nis. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated...

Amazon Linux 2 : qemu (ALAS-2021-1671)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1671 advisory. A heap buffer overflow flaw was found in the iSCSI support of QEMU. This flaw could lead to an out-of- bounds read access and...

Amazon Linux 2 : python-pip (ALAS-2021-1639)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1639 advisory. The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting...

Amazon Linux 2 : lldpad (ALAS-2021-1637)

The version of lldpad installed on the remote host is prior to 1.0.1-5.git036e314. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1637 advisory. lldptool can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an...

Amazon Linux 2 : spamassassin (ALAS-2021-1642)

The version of spamassassin installed on the remote host is prior to 3.4.4-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1642 advisory. A flaw was found in spamassassin. Malicious rule configuration .cf files can be configured to run system commands without any...

Amazon Linux 2 : ruby (ALAS-2021-1641)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1641 advisory. The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an...

Amazon Linux 2 : python3 (ALAS-2021-1640)

The version of python3 installed on the remote host is prior to 3.7.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1640 advisory. The package python/cpython is vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by usin...

Medium: python3

Issue Overview: The package python/cpython is vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon ;, they can cause a difference in the interpretation of...

Amazon Linux 2 : bind (ALAS-2021-1635)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1635 advisory. A flaw was found in bind. The way DNAME records are processed may trigger the same RRset to the ANSWER section to be added more...

Low: lldpad

Issue Overview: lldptool can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an attacker to inject shell control characters into the buffer and impact the behavior of the terminal. CVE-2018-10932 Affected Packages: lldpad Note: This adviso...

Amazon Linux 2 : openldap (ALAS-2021-1638)

The version of openldap installed on the remote host is prior to 2.4.44-23. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1638 advisory. A NULL pointer dereference flaw was found in the OpenLDAP server, during a request for renaming RDNs. This flaw allows a remote,...

Amazon Linux 2 : thunderbird (ALAS-2021-1644)

The version of thunderbird installed on the remote host is prior to 78.10.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1644 advisory. Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both a...

Medium: python-pip

Issue Overview: The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in...

Medium: openldap

Issue Overview: A NULL pointer dereference flaw was found in the OpenLDAP server, during a request for renaming RDNs. This flaw allows a remote, unauthenticated attacker to crash the slapd process by sending a specially crafted request, causing a denial of service. The highest threat from this...

Amazon Linux 2 : kernel (ALAS-2021-1636)

The version of kernel installed on the remote host is prior to 4.14.232-176.381. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1636 advisory. 2024-05-23: CVE-2021-46909 was added to this advisory. 2024-05-23: CVE-2021-46974 was added to this advisory...

Amazon Linux 2 : systemd (ALAS-2021-1643) (deprecated)

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1643 advisory. - A vulnerability in unitdeserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution vi...

Amazon Linux 2 : xorg-x11-server (ALAS-2021-1633)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1633 advisory. A flaw was found in xorg-x11-server. An interger underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and...

Important: xorg-x11-server

Issue Overview: A flaw was found in xorg-x11-server. An interger underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2021-3472 Affected Packages:...

Low: kernel-livepatch-4.14.219-164.354

Issue Overview: A low severity issue was found in the Nitro Enclaves Linux kernel driver that could lead to local privilege escalation. The issue does not break the isolation or security of what is running inside the enclave as the Nitro Enclave's security model already excludes the instance...